CVE-2021-33199
📋 TL;DR
This vulnerability in Expression Engine allows attackers to manipulate file paths through untrusted input, potentially leading to arbitrary file inclusion or remote code execution. It affects Expression Engine installations before version 6.0.3. The issue stems from improper input validation in the addonIcon function.
💻 Affected Systems
- Expression Engine
📦 What is this software?
Expressionengine by Expressionengine
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Arbitrary file inclusion allowing sensitive file disclosure or limited code execution.
If Mitigated
No impact with proper input validation and file path restrictions.
🎯 Exploit Status
The vulnerability appears straightforward to exploit based on the code change, though no public exploit has been documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.0.3
Vendor Advisory: https://github.com/ExpressionEngine/ExpressionEngine/releases/tag/6.0.3
Restart Required: No
Instructions:
1. Backup your Expression Engine installation and database. 2. Download Expression Engine 6.0.3 or later from the official repository. 3. Replace the affected file (system/ee/ExpressionEngine/Addons/file/mod.file.php) with the patched version. 4. Verify the fix by checking that the addonIcon function now uses fixed file names (icon.png, icon.svg) instead of user input.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to restrict file parameter values to allowed filenames only.
Web Application Firewall Rule
allBlock requests containing suspicious file parameter values in the addonIcon function path.
🧯 If You Can't Patch
- Implement strict input validation to only allow 'icon.png' or 'icon.svg' as file parameter values.
- Restrict access to the vulnerable endpoint using network segmentation or authentication requirements.
🔍 How to Verify
Check if Vulnerable:
Check if Expression Engine version is below 6.0.3 by examining the system/ee/ExpressionEngine/Addons/file/mod.file.php file for the vulnerable addonIcon function using user input.Check Version:
Check the Expression Engine control panel or examine the system/ee/ExpressionEngine/Core/Core.php file for version information.Verify Fix Applied:
Verify the patched version 6.0.3 is installed and that the addonIcon function in mod.file.php uses fixed file names (icon.png, icon.svg) instead of input->get('file').📡 Detection & Monitoring
Log Indicators:
- Unusual file parameter values in requests to addonIcon endpoints
- Multiple failed attempts with different file parameter values
Network Indicators:
- Requests to Expression Engine endpoints with non-standard file parameters
- Unusual file paths in HTTP requests
SIEM Query:
web.url: "*addonIcon*" AND web.param.file: NOT ("icon.png" OR "icon.svg")🔗 References
- https://github.com/ExpressionEngine/ExpressionEngine/compare/6.0.1...6.0.3#diff-17bcb23e5666fc2dccb79c7133e9eeb701847f67ae84fbde0a673c3fd3d109e0R508
- https://github.com/ExpressionEngine/ExpressionEngine/releases/tag/6.0.3
- https://github.com/ExpressionEngine/ExpressionEngine/compare/6.0.1...6.0.3#diff-17bcb23e5666fc2dccb79c7133e9eeb701847f67ae84fbde0a673c3fd3d109e0R508
- https://github.com/ExpressionEngine/ExpressionEngine/releases/tag/6.0.3
