CVE-2021-31783
📋 TL;DR
This vulnerability allows attackers to perform Local File Inclusion (LFI) attacks in Piwigo's LocalFilesEditor extension. By manipulating the 'file' parameter in show_default.php without proper validation, attackers can read arbitrary files on the server. This affects all Piwigo installations using vulnerable versions of the LocalFilesEditor extension.
💻 Affected Systems
- Piwigo LocalFilesEditor extension
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through LFI leading to remote code execution, sensitive data exposure, and privilege escalation.
Likely Case
Unauthorized reading of sensitive server files including configuration files, logs, and potentially credentials.
If Mitigated
Limited impact with proper file permissions and web server hardening, though information disclosure may still occur.
🎯 Exploit Status
Simple HTTP request manipulation required. Public GitHub issues demonstrate exploitation methods.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.4.0.1
Vendor Advisory: https://github.com/Piwigo/LocalFilesEditor/commit/dda691d3e45bfd166ac175c70bd8b91cb4917b6b
Restart Required: No
Instructions:
1. Update LocalFilesEditor extension to version 11.4.0.1 or later via Piwigo admin panel. 2. Alternatively, download and install the patched version from GitHub. 3. No server restart required.
🔧 Temporary Workarounds
Disable LocalFilesEditor extension
allTemporarily disable the vulnerable extension until patching is possible
Navigate to Piwigo admin panel > Plugins > Disable LocalFilesEditor
Web server file restriction
linuxConfigure web server to restrict access to show_default.php
# Apache: Add to .htaccess
<Files "show_default.php">
Order Deny,Allow
Deny from all
</Files>
# Nginx: Add to server block
location ~ /show_default\.php$ {
deny all;
}
🧯 If You Can't Patch
- Implement strict web application firewall (WAF) rules to block LFI patterns
- Apply principle of least privilege to web server user and restrict file system access
🔍 How to Verify
Check if Vulnerable:
Check LocalFilesEditor extension version in Piwigo admin panel or examine show_default.php for missing file parameter validationCheck Version:
Check Piwigo admin panel > Plugins > LocalFilesEditor versionVerify Fix Applied:
Verify extension version is 11.4.0.1 or later and test that file parameter manipulation no longer allows directory traversal📡 Detection & Monitoring
Log Indicators:
- HTTP requests to show_default.php with suspicious file parameters containing '../' or similar path traversal sequences
- Unusual file access patterns from web server user
Network Indicators:
- HTTP GET requests with file parameter containing path traversal sequences
- Responses containing server file contents that shouldn't be accessible
SIEM Query:
web.url:*show_default.php* AND (web.query:*file=*../* OR web.query:*file=*..\\*)🔗 References
- https://github.com/Piwigo/LocalFilesEditor/commit/dda691d3e45bfd166ac175c70bd8b91cb4917b6b
- https://github.com/Piwigo/LocalFilesEditor/issues/2
- https://piwigo.org/ext/index.php?cid=null
- https://github.com/Piwigo/LocalFilesEditor/commit/dda691d3e45bfd166ac175c70bd8b91cb4917b6b
- https://github.com/Piwigo/LocalFilesEditor/issues/2
- https://piwigo.org/ext/index.php?cid=null
