Remote Code Execution (RCE)

Vulnerability

The package studio-42/elFinder before version 2.1.58 is vulnerable to Remote Code Execution (RCE) via the upload of a .phar file [1][4]. The upload filter did not disallow .phar files, and many Linux distributions ship Apache configured to process .phar as PHP scripts [4]. This allows an attacker to upload a malicious .phar file that is then executed on the server.

Exploitation

An attacker needs network access to the elFinder instance and must be able to upload files (which is a standard feature) [1][4]. No authentication is required if the connector is exposed publicly, but the exploit can also be performed by an authenticated user. The attacker uploads a .phar file containing arbitrary PHP code. When the file is accessed or triggered by the server's file handling, the PHP code executes in the context of the elFinder connector [4].

Impact

Successful exploitation leads to Remote Code Execution (RCE) with the privileges of the web server user [1][4]. The attacker gains full control over the server's file system and can execute arbitrary commands, potentially leading to complete compromise of the server and its data [1][4].

Mitigation

Update to elFinder version 2.1.58, released on or before 2021-06-13, which associates .phar files with the correct MIME type and blocks their upload unless explicitly allowed [4]. If unable to update, ensure the connector is not exposed without authentication [4]. Administrators should review the additionalMimeMap configuration to block any extensions that can be executed on the web server [4].