CVE-2021-43421: elFinder Unrestricted File Upload vulnerability
Summary
CVE-2021-43421: elFinder Unrestricted File Upload vulnerability. Affects studio-42/elfinder versions >= 2.0.4, < 2.1.60. Fixed in 2.1.60. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
elFinder is an open-source file manager for web applications. It provides a user-friendly interface for managing files and folders on a server. The vulnerability affects versions 2.0.4 to 2.1.59 of the Studio-42 elFinder package. This package is commonly used in PHP-based web applications to enable file management functionality. The vulnerability allows a remote malicious user to upload arbitrary files and execute PHP code through the connector.minimal.php file.
Vulnerability Detail
The vulnerability arises due to insufficient input validation in the connector.minimal.php file. An attacker can exploit this by sending a specially crafted request to the vulnerable server, allowing them to upload malicious files and potentially execute arbitrary PHP code. This can lead to various security risks, including remote code execution, unauthorized access to sensitive data, and server compromise.
How To Fix
Minimum fixed version
2.1.60
This is the first release that contains the fix.
composer require studio-42/elfinder:2.1.60Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can disable or restrict access to the connector.minimal.php file in their web application. This can be achieved by modifying the server configuration or implementing access control measures. However, this workaround may impact the functionality of the file manager component, so upgrading to the patched version is the recommended long-term solution.
Conclusion
The elFinder Unrestricted File Upload vulnerability in the Studio-42 elFinder package can allow remote attackers to upload arbitrary files and execute PHP code. It is crucial for developers to upgrade to the patched version and implement proper input validation to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for studio-42/elfinder →
FAQ
elFinder is an open-source file manager for web applications, providing a user-friendly interface for managing files and folders on a server.
Versions 2.0.4 to 2.1.59 of the Studio-42 elFinder package are affected by this vulnerability.
The vulnerability allows a remote attacker to upload arbitrary files and potentially execute PHP code on the vulnerable server. This can lead to various security risks, including remote code execution, unauthorized access to sensitive data, and server compromise.
To fix this vulnerability, it is recommended to upgrade the Studio-42 elFinder package to version 2.1.60 or later. Additionally, developers should ensure proper input validation and sanitization when handling file uploads.
As a temporary workaround, developers can disable or restrict access to the connector.minimal.php file in their web application. However, upgrading to the patched version is the recommended long-term solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for studio-42/elfinder.
