Preface
- elFinder is a widely popular open-source Web file manager on Github, written with jQuery UI and PHP. Its creation was inspired by the simplicity and convenience of the Finder program used in the Mac OS X operating system.
Vulnerability Description
- The vulnerability originates from the server's failure to strictly filter the name parameter in the request when a user creates a new zip archive with elFinder. This causes the parameter to be passed into the prox_open function for execution, which in turn results in a remote code execution vulnerability.
Vulnerability Severity
- Critical (CVSS: 9.8)
Affected Versions
- elFinder < 2.1.59
Environment Setup
Download the Source Code
-
elFinder's Github address: https://github.com/Studio-42/elFinder
-
Source code download for the vulnerable version: https://github.com/Studio-42/elFinder/releases/tag/2.1.58
Local Deployment
-
After downloading it to the local Web server directory, rename the /php/connector.minimal.php-dist file in the source code directory to /php/connector.minimal.php
-
Then open /elfinder.html in the browser, as shown below:
PhpStorm + Xdebug Debugging Environment Setup
- Timeout issue:
https://blog.csdn.net/xkdlzy/article/details/110880645
https://www2.xiebruce.top/1191.html
File Modifications
- elFinderVolumeDriver.class.php
第6762行代码，cmd参数由phpfunction修改为zip
- elFinderVolumeDriver.class.php
第465行代码，useRemoteArchive参数由false修改为true
Vulnerability Analysis
str_replace() ->
Vulnerability Reproduction
POC and EXP Development
Reference Links
1.https://github.com/Studio-42/elFinder/issues/3295
2.https://xz.aliyun.com/t/10739