Original post of this article
Immediate triage urged as researchers warn in-the-wild exploitation likely
Critical vulnerabilities in elFinder, the popular open source web file manager, can enable unauthenticated attackers to execute arbitrary PHP code on servers hosting elFinder’s back-end PHP connector.
Security researchers have documented five vulnerability chains that combine otherwise “innocuous bugs” to forge exploit chains capable of seizing control of servers.
Other products at risk
Fortunately, the flaws were recently patched. Thomas Chauchefoin, vulnerability researcher at SonarSource, urged users to update their systems as soon as possible.
“There is no doubt these vulnerabilities will also be exploited in the wild, because exploits targeting old versions have been publicly released and the connectors filenames are part of compilations of paths to look for when trying to compromise websites,” he said in a blog post.
“Arbitrary code execution was easily demonstrated, and attackers won’t have much trouble replicating it”, he added.
Worse still, the impact potentially extends well beyond elFinder. “All these bug classes are very common in software that exposes filesystems to users, and are likely to impact a broad range of products,” explained Chauchefoin.
All rated CVSS 9.8, the flaws include four issues affecting elFinder 2.1.58 that can enable attackers to move or delete arbitrary files, as well as argument injection and race condition bugs (CVE-2021-32682).
All five flaws bar the race condition bug affect elFinder in its default ‘safe’ configuration, which was introduced in the wake of in-the-wild attacks targeting the application’s previous configuration, according to Chauchefoin.
The vulnerabilities were reported to the project maintainers on March and patched in version 2.1.59, which was released in June. SonarSource published technical details on August 17.
As well as updating systems, Chauchefoin advises users to enforce strong access control on the connector as an additional security control.
Chauchefoin expressed hope that the findings from his team’s research would help “break future bug chains and reduce the risk of similar issues”.
He added: “We also learned that working with paths is not easy and that extra measures should be taken: performing additional checks in the ‘low-level’ functions, using and with confidence (and knowing their limits!) and always validating user-controlled data.”
Chauchefoin suggested that web file managers remain a source of concern over security.
“An application’s interaction with the file system is always highly security sensitive, since minor functional bugs can easily be the source of exploitable vulnerabilities,” he explained.
“This observation is especially true in the case of web file managers, whose role is to replicate the features of a complete file system and expose it to the client’s browser in a transparent way.”