CVE-2021-45919

Vulnerability

Studio 42 elFinder versions up to and including 2.1.31 are vulnerable to stored cross-site scripting (XSS) through the file upload functionality. An attacker can upload a specially crafted SVG document that, when viewed or processed by the application, executes arbitrary JavaScript in the context of the victim's session [1].

Exploitation

An attacker with the ability to upload files to an elFinder instance can exploit this vulnerability by uploading an SVG file containing embedded JavaScript. No additional authentication or user interaction beyond viewing the uploaded file is required for the XSS to trigger [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the elFinder application. This can lead to session hijacking, data theft, or further compromise of the web application depending on the privileges of the affected user [1].

Mitigation

As of the publication date (2022-02-08), no official patch or fixed version has been released for this vulnerability. Users are advised to restrict SVG file uploads or disable the upload functionality until a fix is available. The vulnerability affects all versions through 2.1.31 [1].