Patchfirst
Patchfirst
CVE-2021-32682 Public exploit Critical · 9.8 EPSS 69.9%

Multiple vulnerabilities leading to RCE

Studio-42 · elFinder

Summary

The flaw affects Studio-42's elFinder, an open-source JavaScript and jQuery UI file manager, specifically its PHP connector component, which is where the vulnerabilities reside. An attacker reaching the elFinder PHP connector over the network without authentication can exploit path traversal, server-side request forgery, and OS command injection flaws to execute arbitrary code and commands on the hosting server, even with minimal configuration.

Official description · CVE.org

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. The issues were patched in version 2.1.59. As a workaround, ensure the connector is not exposed without authentication.

Breakdown
31.7 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Public exploit code (Metasploit) was available 1 day before disclosure.

  1. Public exploit codeMetasploit1 day before
  2. Disclosedday 0

See the family tree

6 related vulnerabilities in the same code over 3 years. The latest fix listed for studio-42/elfinder is 2.1.61.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. CVE-2019-5884php/elFinder.class.php in elFinder before 2.1.45 leaks…10 Jan 2019
  2. Next fix in the same packageLow

    Why these are linked:

    • Fixed one release later2.1.45 → 2.1.48 (studio-42/elfinder)
    CVE-2019-9194elFinder before 2.1.48 has a command injection vulnerability in…26 Feb 2019
  3. relatedMedium

    Why these are linked:

    CVE-2021-23394Remote Code Execution (RCE)13 Jun 2021
  4. relatedHigh

    Why these are linked:

    This CVECVE-2021-32682Multiple vulnerabilities leading to RCE14 Jun 2021
  5. relatedHigh

    Why these are linked:

    • Fixed one release later2.1.59 → 2.1.60 (studio-42/elfinder)
    • Same code patched: elFinderVolumeLocalFileSystem.class.php (machine-matched)Functions: __constructcommit a106c35commit c08bcbf
    • Similar weakness in the same product (machine-matched)same package + description similarity
    CVE-2021-43421A File Upload vulnerability exists in Studio-42 elFinder 2.0.4…7 Apr 2022
  6. Next fix in the same packageHigh

    Why these are linked:

    • Fixed one release later2.1.60 → 2.1.61 (studio-42/elfinder)
    • Same code patched: elFinderVolumeLocalFileSystem.class.php (machine-matched)commit c08bcbfcommit 69be51e
    • Similar weakness in the same product (machine-matched)same package + description similarity
    CVE-2022-27115In Studio-42 elFinder 2.1.60, there is a vulnerability that…11 Apr 2022

Fixes in studio-42/elfinderPackagist package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 2.1.48CVE-2019-919426 Feb 2019
  2. 2.1.49CVE-2019-625714 Jan 2019
  3. 2.1.58CVE-2021-2339413 Jun 2021
  4. 2.1.59CVE-2021-3268214 Jun 2021
  5. 2.1.60CVE-2021-434217 Apr 2022
  6. 2.1.61CVE-2022-2696021 Mar 2022
  7. 2.1.61CVE-2022-2711511 Apr 2022Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: studio-42/elfinder.

Packagiststudio-42/elfinderGHSA-wph3-44rj-92pr

Upgrade to 2.1.59 or later

Fixes this CVE and 2 other known vulnerabilities in this package (CVE-2019-9194, CVE-2021-23394).

Set the version to 2.1.59 or later in your composer.json.

The first fix for CVE-2021-32682.

Affected versions

If you runUpgrade to
All versions before 2.1.592.1.59

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

4 links, grouped by NVD tag

x_refsource_CONFIRM 1

github.com/Studio-42/elFinder/security/advisories/GHSA-wph3-44rj-92pr

x_refsource_MISC 3

github.com/Studio-42/elFinder/commit/a106c350b7dfe666a81d6b576816db9fe0899b17packetstormsecurity.com/files/164173/elFinder-Archive-Command-Injection.htmlblog.sonarsource.com/elfinder-case-study-of-web-file-manager-vulnerabilities/
↑ ↓ chooseEnter openEsc close