CVE-2021-23394
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary PHP code on servers running vulnerable versions of elFinder file manager. Attackers can upload malicious .phar files that get executed as PHP code. This affects any system using elFinder versions before 2.1.58 where the server is configured to parse .phar files as PHP.
💻 Affected Systems
- elFinder
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise allowing attackers to execute arbitrary commands, access sensitive data, install backdoors, or pivot to other systems.
Likely Case
Unauthorized file upload leading to web shell installation, data exfiltration, or lateral movement within the network.
If Mitigated
Limited impact if proper file upload restrictions and PHP configuration hardening are in place.
🎯 Exploit Status
Exploitation requires file upload capability and specific server configuration. Public proof-of-concept code exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.58 and later
Vendor Advisory: https://github.com/Studio-42/elFinder/commit/75ea92decc16a5daf7f618f85dc621d1b534b5e1
Restart Required: No
Instructions:
1. Update elFinder to version 2.1.58 or later. 2. Replace the entire elFinder directory with the patched version. 3. Clear any caches if applicable.
🔧 Temporary Workarounds
Disable .phar file execution
allConfigure PHP to not execute .phar files as PHP code
Add to php.ini: phar.readonly = On
Add to .htaccess: RemoveHandler .phar
Add to nginx config: location ~ \.phar$ { deny all; }
Restrict file uploads
allConfigure elFinder to block .phar file uploads
Add to elFinder connector configuration: 'uploadDeny' => array('phar')
🧯 If You Can't Patch
- Disable elFinder file upload functionality completely
- Implement strict WAF rules to block .phar file uploads and execution attempts
🔍 How to Verify
Check if Vulnerable:
Check elFinder version in source code or composer.json. If version is below 2.1.58, check if server executes .phar files by uploading a test file.Check Version:
grep -r 'version' elFinder/composer.json or check elFinder/js/elfinder.js for version stringVerify Fix Applied:
Verify elFinder version is 2.1.58 or higher. Test that .phar file uploads are blocked or not executed.📡 Detection & Monitoring
Log Indicators:
- File uploads with .phar extension
- PHP execution errors related to .phar files
- Unusual file creation in elFinder upload directories
Network Indicators:
- HTTP POST requests with .phar file uploads to elFinder endpoints
- Subsequent requests to uploaded .phar files
SIEM Query:
source="web_logs" AND (uri="*connector*" AND file_extension="phar") OR (uri="*.phar" AND referer="*elfinder*")🔗 References
- https://blog.sonarsource.com/elfinder-case-study-of-web-file-manager-vulnerabilities/
- https://github.com/Studio-42/elFinder
- https://github.com/Studio-42/elFinder/commit/75ea92decc16a5daf7f618f85dc621d1b534b5e1
- https://github.com/Studio-42/elFinder/issues/3295
- https://snyk.io/vuln/SNYK-PHP-STUDIO42ELFINDER-1290554
- https://blog.sonarsource.com/elfinder-case-study-of-web-file-manager-vulnerabilities/
- https://github.com/Studio-42/elFinder
- https://github.com/Studio-42/elFinder/commit/75ea92decc16a5daf7f618f85dc621d1b534b5e1
- https://github.com/Studio-42/elFinder/issues/3295
- https://snyk.io/vuln/SNYK-PHP-STUDIO42ELFINDER-1290554
