50 lines
1.9 KiB
YAML
50 lines
1.9 KiB
YAML
|
id: CVE-2021-32682
|
||
|
|
|
||
|
|
info:
|
||
|
name: elFinder 2.1.58 - Remote Code Execution
|
||
|
|
author: smaranchand
|
||
|
|
severity: critical
|
||
|
description: elFinder 2.1.58 is impacted by multiple remote code execution vulnerabilities that could allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration.
|
||
|
|
reference:
|
||
|
|
- https://smaranchand.com.np/2022/01/organization-vendor-application-security/
|
||
|
|
- https://blog.sonarsource.com/elfinder-case-study-of-web-file-manager-vulnerabilities
|
||
|
|
- https://github.com/Studio-42/elFinder/security/advisories/GHSA-wph3-44rj-92pr
|
||
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2021-32682
|
||
|
|
remediation: Update to elFinder 2.1.59 or later. As a workaround, ensure the connector is not exposed without authentication.
|
||
|
classification:
|
||
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
||
|
cvss-score: 9.8
|
||
|
|
cve-id: CVE-2021-32682
|
||
|
|
cwe-id: CWE-22,CWE-78,CWE-918
|
||
|
|
metadata:
|
||
|
|
github: https://github.com/Studio-42/elFinder
|
||
|
|
tags: cve,cve2021,elfinder,misconfig,rce,oss
|
||
|
|
|
||
|
http:
|
||
|
|
- method: GET
|
||
|
|
path:
|
||
|
|
- "{{BaseURL}}/admin/elfinder/elfinder-cke.html"
|
||
|
|
- "{{BaseURL}}/assets/backend/elfinder/elfinder-cke.html"
|
||
|
|
- "{{BaseURL}}/assets/elFinder-2.1.9/elfinder.html"
|
||
|
|
- "{{BaseURL}}/assets/elFinder/elfinder.html"
|
||
|
|
- "{{BaseURL}}/backend/elfinder/elfinder-cke.html"
|
||
|
|
- "{{BaseURL}}/elfinder/elfinder-cke.html"
|
||
|
|
- "{{BaseURL}}/uploads/assets/backend/elfinder/elfinder-cke.html"
|
||
|
|
- "{{BaseURL}}/uploads/assets/backend/elfinder/elfinder.html"
|
||
|
|
- "{{BaseURL}}/uploads/elfinder/elfinder-cke.html"
|
||
|
|
|
||
|
|
stop-at-first-match: true
|
||
|
|
matchers-condition: and
|
||
|
|
matchers:
|
||
|
|
- type: word
|
||
|
|
words:
|
||
|
|
- "elfinder"
|
||
|
|
- "php/connector"
|
||
|
|
condition: and
|
||
|
|
|
||
|
|
- type: status
|
||
|
|
status:
|
||
|
|
- 200
|
||
|
|
|
||
|
|
# Enhanced by mp on 2022/04/19
|