CVE-2021-23415
📋 TL;DR
This vulnerability in elFinder.AspNet allows path traversal attacks due to improper sanitization of user-controlled file names. Attackers can potentially write files outside intended directories, leading to arbitrary file uploads. This affects all users of elFinder.AspNet before version 1.1.1.
💻 Affected Systems
- elFinder.AspNet
📦 What is this software?
Elfinder.aspnet by Elfinder.aspnet Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution via arbitrary file upload leading to complete system compromise.
Likely Case
Arbitrary file write allowing data manipulation, defacement, or information disclosure.
If Mitigated
Limited impact with proper file system permissions and input validation in place.
🎯 Exploit Status
Requires authenticated access to elFinder interface. Path traversal techniques are well-documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.1
Vendor Advisory: https://github.com/mguinness/elFinder.AspNet/commit/675049b39284a9e84f0915c71d688da8ebc7d720
Restart Required: Yes
Instructions:
1. Update NuGet package to version 1.1.1 or later. 2. Rebuild and redeploy application. 3. Restart application pool or service.
🔧 Temporary Workarounds
Input Validation Filter
allImplement custom input validation to sanitize file names before processing.
Implement server-side validation to reject file names containing '../', '..\', or other path traversal sequences.
File System Restrictions
allConfigure strict file system permissions to limit write access.
Set appropriate ACLs to restrict elFinder's write access to intended directories only.
🧯 If You Can't Patch
- Disable file upload functionality in elFinder configuration.
- Implement web application firewall rules to block path traversal patterns.
🔍 How to Verify
Check if Vulnerable:
Check installed NuGet package version in project file or via Package Manager Console: Get-Package -ProjectName YourProjectName | Where-Object {$_.Id -eq 'elFinder.AspNet'}Check Version:
Get-Package -ProjectName YourProjectName | Where-Object {$_.Id -eq 'elFinder.AspNet'} | Select-Object VersionVerify Fix Applied:
Confirm package version is 1.1.1 or higher and test file upload with malicious file names containing path traversal sequences.📡 Detection & Monitoring
Log Indicators:
- File operations with suspicious file names containing '../' or '..\' patterns
- Unauthorized file write attempts outside expected directories
Network Indicators:
- HTTP POST requests to elFinder endpoints with encoded path traversal sequences
SIEM Query:
source="web_server" AND (uri="*/elfinder/*" AND (file_name="*../*" OR file_name="*..\\*"))