Zero-day in jQuery plugin sample code exploited for at least three years

Re:Zero-day in jQuery plugin sample code exploited for at le... by galaxyLogic on Sunday October 21, 2018 @04:19PM (#18269960)

Isn't a JQuery Plugin something that executes on the client-side? If so then how can something on the client-side compromise the security of a server? Isn't the fault on the server-side?

Or is this a PHP server-plugin which if installed on a PHP server makes them insecure? But of course anything you install on server can make it insecure. No?

[ Parent | on HN ]

Re:Zero-day in jQuery plugin sample code exploited for at le... by runn1ng on Sunday October 21, 2018 @10:38PM (#18271767)

There is an example PHP code in the same repo and people copy-pasted that into production.

The issue is not in the front-end jQuery library, despite the title.

[ Parent | on HN ]

Re:Zero-day in jQuery plugin sample code exploited for at le... by CharlesW on Sunday October 21, 2018 @04:29PM (#18270034)

> If so then how can something on the client-side compromise the security of a server?

This is answered in the plug-in author's thorough note, posted a couple hours before you posted this.

[ Parent | on HN ]

Re:Zero-day in jQuery plugin sample code exploited for at le... by blueimp on Sunday October 21, 2018 @05:43PM (#18270479)

For a breakdown on how this could happen, please see my comment here: https://news.ycombinator.com/item?id=18267309

[ Parent | on HN ]