JQuery 1

The finding behind tenable:106657 maps to jQuery’s old habit of auto-executing text/javascript returned from a cross-domain Ajax request when developers used $.ajax() / $.get() without an explicit dataType. Tenable flags jQuery 1.x before 1.12.0 and 2.x before 2.2.0, because the jQuery 1.12.0 / 2.2.0 releases added a mitigation for this behavior. The broader CVE record, CVE-2015-9251, was later scoped as affecting jQuery before 3.0.0, which is why this plugin often under-describes the real version story.

Vendor MEDIUM is fair in a lab, but still a bit generous for enterprise patch triage. The bug is only reachable when the application actually makes a vulnerable cross-origin Ajax call to an attacker-controlled or compromised endpoint, and most sites simply do not do that in a way an external attacker can steer on demand. This is real, but it is heavily conditional, highly application-specific, and a terrible candidate for emergency patching across 10,000 hosts.

Why this verdict

• Downgrade for prerequisite chain: the attacker does not get value from the library version alone; they need a live cross-origin $.ajax() / $.get() call with no explicit dataType.
• Downgrade for attacker position: requiring control of a third-party response path implies either compromise of an external service, misrouting, or application-specific endpoint abuse. That is much narrower than unauthenticated direct exploitation.
• Downgrade for blast radius: successful exploitation lands in the victim browser session, not as direct server-side code execution or broad host compromise.
• Slight upward pressure: public demos exist and EPSS is higher than many medium-severity bugs, so this is not noise-only.

Why not higher?

There is no direct pre-auth server compromise path here. The exploit chain depends on a fragile combination of front-end coding pattern, cross-origin request behavior, and attacker control of the response source; that is too much real-world friction for MEDIUM-or-higher patch urgency across a large fleet.

Why not lower?

This is still a real client-side execution issue with public repro steps, and some legacy apps absolutely do make unsafe jQuery cross-domain calls. If one of your internet-facing portals relies on this pattern, the result can still be credential theft or session abuse for active users.

1. Inventory the code path — Within backlog hygiene timing for a LOW issue, confirm whether the app actually performs cross-origin jQuery Ajax without explicit dataType. This is the single fastest way to separate real exposure from scanner noise.
2. Eliminate browser-to-third-party Ajax where possible — Move third-party API calls server-side or through a same-origin proxy so the browser is not executing trust decisions on remote content. For this LOW verdict, fold this into normal engineering backlog rather than emergency change windows.
3. Set explicit dataType on legacy jQuery requests — Where legacy code must stay, force dataType: 'json' or another expected type so script auto-execution is not inferred from response headers. Do this during the next planned maintenance cycle.
4. Harden CSP — Use a stricter script-src and eliminate unnecessary execution allowances to reduce the payoff of browser-side script injection. CSP is not a perfect fix here, but it can reduce downstream abuse while you clean up old front-end code.

Run this on the target web server, build artifact directory, or unpacked static-content repo that actually hosts front-end assets. Invoke it as python3 verify_jquery_106657.py /var/www/html or point it at your CI artifact root; no admin rights are required beyond read access to the files.

#!/usr/bin/env python3
# verify_jquery_106657.py
# Purpose: validate whether local jQuery assets match Tenable plugin 106657 conditions.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN/usage error

import os
import re
import sys
from typing import Optional, Tuple

VERSION_RE = re.compile(r"jQuery v?(\d+)\.(\d+)\.(\d+)", re.I)
FILENAME_RE = re.compile(r"jquery(?:[-.]min)?[-.]?(\d+)\.(\d+)\.(\d+)", re.I)
JS_EXT = (".js", ".jsp", ".html", ".htm", ".cshtml", ".php", ".twig")


def parse_version(text: str) -> Optional[Tuple[int, int, int]]:
    m = VERSION_RE.search(text)
    if m:
        return tuple(map(int, m.groups()))
    m = FILENAME_RE.search(text)
    if m:
        return tuple(map(int, m.groups()))
    return None


def classify(ver: Tuple[int, int, int]) -> str:
    major, minor, patch = ver
    # Tenable plugin 106657 logic
    if major == 1 and ver < (1, 12, 0):
        return "VULNERABLE"
    if major == 2 and ver < (2, 2, 0):
        return "VULNERABLE"

    # Important nuance: broader CVE-2015-9251 language says < 3.0.0.
    # Versions 1.12.x and 2.2.x contain the mitigation Tenable is looking for,
    # but may still be treated as affected by broader CVE records.
    if major in (1, 2) and ver >= ((1, 12, 0) if major == 1 else (2, 2, 0)):
        return "UNKNOWN"

    if major >= 3:
        return "PATCHED"

    return "UNKNOWN"


def inspect_file(path: str) -> Optional[Tuple[Tuple[int, int, int], str]]:
    # First try filename
    ver = parse_version(os.path.basename(path))
    if ver:
        return ver, classify(ver)

    # Then read a small chunk from the file body for the jQuery banner
    try:
        with open(path, "r", encoding="utf-8", errors="ignore") as f:
            chunk = f.read(65536)
        ver = parse_version(chunk)
        if ver:
            return ver, classify(ver)
    except Exception:
        return None
    return None


def main() -> int:
    if len(sys.argv) != 2:
        print("UNKNOWN - usage: python3 verify_jquery_106657.py <webroot-or-artifact-dir>")
        return 2

    root = sys.argv[1]
    if not os.path.exists(root):
        print(f"UNKNOWN - path does not exist: {root}")
        return 2

    findings = []
    for base, _, files in os.walk(root):
        for name in files:
            if not name.lower().endswith(JS_EXT):
                continue
            path = os.path.join(base, name)
            result = inspect_file(path)
            if result:
                ver, state = result
                findings.append((path, ver, state))

    if not findings:
        print("UNKNOWN - no identifiable jQuery assets found")
        return 2

    vulnerable = [f for f in findings if f[2] == "VULNERABLE"]
    unknown = [f for f in findings if f[2] == "UNKNOWN"]
    patched = [f for f in findings if f[2] == "PATCHED"]

    if vulnerable:
        path, ver, _ = vulnerable[0]
        print(f"VULNERABLE - found jQuery {ver[0]}.{ver[1]}.{ver[2]} at {path}")
        return 1

    if unknown:
        sample = unknown[0]
        path, ver, _ = sample
        print(f"UNKNOWN - found jQuery {ver[0]}.{ver[1]}.{ver[2]} at {path}; Tenable plugin condition may be mitigated, but broader CVE-2015-9251 scope should be reviewed")
        return 2

    path, ver, _ = patched[0]
    print(f"PATCHED - found jQuery {ver[0]}.{ver[1]}.{ver[2]} at {path}")
    return 0


if __name__ == "__main__":
    sys.exit(main())

Sources

1. Tenable plugin 106657
2. Official jQuery 1.12.0 / 2.2.0 release notes
3. jQuery issue #2432
4. jQuery mitigation commit f60729f
5. NVD CVE-2015-9251
6. CISA Known Exploited Vulnerabilities Catalog
7. Bitsight CVE-2015-9251 observation footprint
8. Debian security tracker for CVE-2015-9251