CVE-2021-27341
📋 TL;DR
OpenSIS Community Edition versions up to 7.6 contain a local file inclusion vulnerability in DownloadWindow.php via the 'filename' parameter. This allows attackers to read arbitrary files from the server filesystem. All users running affected versions are vulnerable.
💻 Affected Systems
- OpenSIS Community Edition
📦 What is this software?
Opensis by Os4ed
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through reading sensitive files like configuration files, password hashes, or database credentials, potentially leading to remote code execution.
Likely Case
Unauthorized access to sensitive system files, configuration data, or user information stored on the server.
If Mitigated
Limited impact with proper file permissions and web server sandboxing, but still potential information disclosure.
🎯 Exploit Status
The vulnerability is simple to exploit by manipulating the filename parameter in HTTP requests to DownloadWindow.php.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after commit f78407d5291c686c3f416073dcb9143f3a3d5489
Vendor Advisory: https://github.com/OS4ED/openSIS-Classic/issues/158
Restart Required: No
Instructions:
1. Update to the latest version of OpenSIS Community Edition. 2. Apply the patch from commit f78407d5291c686c3f416073dcb9143f3a3d5489. 3. Verify the fix by checking that DownloadWindow.php properly validates filename parameters.
🔧 Temporary Workarounds
Web Application Firewall Rule
allBlock requests containing directory traversal sequences in the filename parameter
File Permission Restriction
linuxRestrict web server user permissions to limit accessible files
chmod 600 sensitive_config_files
chown root:root sensitive_files
🧯 If You Can't Patch
- Implement strict input validation in DownloadWindow.php to reject directory traversal sequences
- Disable or restrict access to DownloadWindow.php if not required for functionality
🔍 How to Verify
Check if Vulnerable:
Test by accessing DownloadWindow.php with a filename parameter containing directory traversal sequences like '../../etc/passwd'Check Version:
Check OpenSIS version in admin panel or configuration filesVerify Fix Applied:
Attempt the same test after patching - should receive error or sanitized output📡 Detection & Monitoring
Log Indicators:
- HTTP requests to DownloadWindow.php with suspicious filename parameters containing '../' sequences
- Unusual file access patterns from web server process
Network Indicators:
- HTTP GET/POST requests with filename parameter containing path traversal attempts
SIEM Query:
web.url:*DownloadWindow.php* AND (web.param.filename:*../* OR web.param.filename:*..\*)🔗 References
- https://github.com/OS4ED/openSIS-Classic/commit/f78407d5291c686c3f416073dcb9143f3a3d5489#diff-24b751f2072f058259d033016938101f9fa29884ebcc09ce7eb88def3421e5ba
- https://github.com/OS4ED/openSIS-Classic/issues/158
- https://github.com/OS4ED/openSIS-Classic/releases
- https://github.com/OS4ED/openSIS-Classic/commit/f78407d5291c686c3f416073dcb9143f3a3d5489#diff-24b751f2072f058259d033016938101f9fa29884ebcc09ce7eb88def3421e5ba
- https://github.com/OS4ED/openSIS-Classic/issues/158
- https://github.com/OS4ED/openSIS-Classic/releases
