PT-2021-3443 · Elfinder · Elfinder

Nao-Pon · Published 2021-06-14 · Updated 2022-11-09 · CVE-2021-32682

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions elFinder versions 2.1.58

Description The issue is related to the incorrect implementation of the authentication mechanism in the elFinder file manager. This can allow a remote attacker to execute arbitrary code. Several vulnerabilities affect elFinder, allowing an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration.

Recommendations For elFinder version 2.1.58, update to version 2.1.59 to resolve the issue. As a temporary workaround for version 2.1.58, ensure the connector is not exposed without authentication.

Exploit

Fix

SSRF

Path traversal

OS Command Injection

Missing Authentication

Weakness Enumeration

CWE-918

CWE-22

CWE-78

CWE-306

Related Identifiers

BDU:2021-03303

CVE-2021-32682

GHSA-WPH3-44RJ-92PR

Affected Products

Elfinder

References · 24

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/elfinder_archive_cmd_injection.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/164173/elFinder-Archive-Command-Injection.html · Exploit
• 🔥 https://blog.sonarsource.com/elfinder-case-study-of-web-file-manager-vulnerabilities · Exploit
• https://github.com/Studio-42/elFinder/commit/a106c350b7dfe666a81d6b576816db9fe0899b17 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-32682 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32682 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03303 · Security Note
• https://osv.dev/vulnerability/GHSA-wph3-44rj-92pr · Vendor Advisory
• https://github.com/Studio-42/elFinder · Note
• https://github.com/Studio-42/elFinder/security/advisories/GHSA-wph3-44rj-92pr · Note
• https://github.com/Studio-42/elFinder/security/advisories/GHSA-qm58-cvvm-c5qr · Note
• https://t.me/cybersecuritytechnologies/4133 · Telegram Post
• https://t.me/secharvester/11391 · Telegram Post
• https://t.me/cvenotify/20976 · Telegram Post
• https://t.me/cvenotify/16274 · Telegram Post