Barracuda has found multiple instances of OS Command Injection vulnerabilities in a static website. In each instance, the vulnerable URL was the jQuery plugin itself (version 2.1.1).
Barracuda rates each Severity as Critical, and the Confidence as Certain.
An OS command injection attack occurs when an attacker attempts to execute system level commands through a vulnerable application. Applications are considered vulnerable to the OS command injection attack if they utilize user input in a system level command.
Minimize use of OS commands in web applications, as they are always a security risk. When it is necessary to use an OS command that includes user input, comprehensively scrub all user input for malicious characters prior to running the command.
The issue details are "The field v was submitted with the value /bin/cat /etc/passwd. The marker root:" followed by a huge chunk of minified jQuery (6 pages), and ends with "fa+";expires=Thu, 01 Jan 1970 00:00:00 was found in the response, suggesting that the injected command was executed, and therefore that OS command injection is possible.".
There were also High Severity in the same jQuery plugin for Directory Traversal:
Directory Traversal, also known as Path Traversal, "dot-dot-slash" and "backtracking", is when a misconfigured server or code error allows an attacker access to files outside the web root folder. These files may contain source code, configuration, and critical system files, including password files.
CVSS Score: 6.8
Do not use user input that is not properly sanitized as any part of a path component. It is even more advisable to never use user input in a path component at all.
Again, the details were "The v parameter was submitted with the value /etc/passwd, and the response contained the value root:" followed by 6 pages of minified jQuery.
I'm going through all of the forms to verify that the inputs are, in fact, properly sanitized, but the report seems to be identifying the vulnerabilities in jQuery 2.1.1 itself.
That strikes me as unlikely, but I'd like to be able to know for sure if these are, in fact, false positives. I will be updating to a more recent version of jQuery, just to be safe. What steps should I take beyond investigating the form inputs and updating jQuery?