News for hackers. Stuff that matters.

A comment on Zero-day in jQuery plugin sample code exploited for at least three years.

Re:Zero-day in jQuery plugin sample code exploited for at le... by fulafel on Monday October 22, 2018 @01:29AM (#18272407)
What other vulnerabilities did this backwards-incompatible Apache change cause? Probably many people rely on .htaccess, for example to disable access to non-public files or disable php execution on a DIY CMS file sharing area.

Sounds like the risk from this is not widely known. Probably the correct solution for Apache would have been to detect presence of now-ignored .htaccess files and signal an error.

[ Parent | on HN ]
Re:Zero-day in jQuery plugin sample code exploited for at le... by blueimp on Monday October 22, 2018 @11:16AM (#18275309)
That was my thought as well.

I think one of the reasons nobody reported this earlier was that people simply assumed that .htaccess support was the default - Larry Cashdollar, the security researcher, also confirmed this: https://news.ycombinator.com/item?id=18271880

[ Parent | on HN ]