PT-2024-14373 · Studio 42 · Elfinder

Passtheticket · Published 2024-10-31 · Updated 2024-11-04 · CVE-2023-52044

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Studio-42 eLfinder versions 2.1.62 and prior

Description The issue is related to Remote Code Execution (RCE) due to the lack of restriction for uploading files with the .php8 extension. This allows users to upload malicious files, potentially leading to RCE. The estimated number of affected devices is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For Studio-42 eLfinder versions 2.1.62 and prior, update to the latest version to mitigate risks. As a temporary workaround, consider restricting the upload of files with the .php8 extension to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-52044

Affected Products

Elfinder

References · 10

• 🔥 https://github.com/Studio-42/elFinder/issues/3615 · Exploit
• https://osv.dev/vulnerability/CVE-2023-52044 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-52044 · Security Note
• https://twitter.com/VulmonFeeds/status/1852091148745015335 · Twitter Post
• https://twitter.com/transilienceai/status/1852419076557287491 · Twitter Post
• https://twitter.com/transilienceai/status/1852419082752274572 · Twitter Post
• https://twitter.com/transilienceai/status/1853300265992241581 · Twitter Post
• https://twitter.com/transilienceai/status/1853300273160282499 · Twitter Post
• https://t.me/cvedetector/9532 · Telegram Post
• https://twitter.com/CVEnew/status/1852066492822753649 · Twitter Post