elFinder 2.1.58 - Remote Code Execution
ID: elfinder-version
Severity: critical
Author: idealphase
Tags: tech,elfinder,oss
Description
Section titled “Description”elFinder 2.1.58 is vulnerable to remote code execution. This can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration.
YAML Source
Section titled “YAML Source”id: elfinder-version
info: name: elFinder 2.1.58 - Remote Code Execution author: idealphase severity: critical description: elFinder 2.1.58 is vulnerable to remote code execution. This can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. remediation: The issues were patched in version 2.1.59. As a workaround, ensure the connector is not exposed without authentication. reference: - https://github.com/Studio-42/elFinder/ classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H cvss-score: 10 cwe-id: CWE-77 metadata: max-request: 2 tags: tech,elfinder,oss
http: - method: GET path: - "{{BaseURL}}/js/elfinder.min.js" - "{{BaseURL}}/js/elFinder.version.js"
matchers-condition: and matchers: - type: word part: body words: - "elFinder - file manager for web" - "elFinder.prototype.version =" condition: or
- type: status status: - 200
extractors: - type: regex group: 1 regex: - '\* Version (.+) \(' - "elFinder.prototype.version = '([0-9.]+)';"# digest: 4a0a00473045022100ba55ad23cc320cce901dc53bc3d573c0576f4efa58bc4d507a7b1c9e8aef525502201255874bf5dddbc7e91add058fcc47abe018c7998ef4ad6c018ca37bd9f9f637:922c64590222798bb761d5b6d8e72950Guide to check the vulnerabilities
Section titled “Guide to check the vulnerabilities”This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.
$ nuclei -u "URL" -t "http/technologies/elfinder-version.yaml"