Vulnerability · Published Jun 14, 2021 · Assigned by GitHub_M

CVE-2021-32682Multiple vulnerabilities leading to RCE

Critical 9.8

In plain English

A critical-severity server-side request forgery in elFinder from Studio-42. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 69.9% (higher than 99.4% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)69.9%top 0.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling2Metasploit, Nuclei

Official description

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. The issues were patched in version 2.1.59. As a workaround, ensure the connector is not exposed without authentication.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	studio-42/elfinder	2.1.59	GHSA-wph3-44rj-92pr

Affected products (as reported)

Vendor	Product	Versions
Studio-42	elFinder	= 2.1.58

Weakness: CWE-918, CWE-22, CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/Studio-42/elFinder/security/advisories/GHSA-wph3-44rj-92pr x_refsource_CONFIRM
https://github.com/Studio-42/elFinder/commit/a106c350b7dfe666a81d6b576816db9fe0899b17 x_refsource_MISC
http://packetstormsecurity.com/files/164173/elFinder-Archive-Command-Injection.html x_refsource_MISC
https://blog.sonarsource.com/elfinder-case-study-of-web-file-manager-vulnerabilities/ x_refsource_MISC