CVE-2021-43691
📋 TL;DR
CVE-2021-43691 is a path traversal vulnerability in tripexpress v1.1 that allows attackers to write arbitrary files to the server filesystem by manipulating the src parameter in load_font.php. This affects all installations of tripexpress v1.1 that have the vulnerable component accessible. Attackers can potentially achieve remote code execution.
💻 Affected Systems
- tripexpress
📦 What is this software?
Tripexpress by Tripexpress Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Arbitrary file write leading to web shell deployment, data manipulation, or denial of service.
If Mitigated
Limited impact if proper file permissions restrict write access to critical directories.
🎯 Exploit Status
Exploitation requires sending crafted requests to the vulnerable endpoint with path traversal sequences.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://github.com/toocool/tripexpress/issues/40
Restart Required: No
Instructions:
No official patch exists. Remove or restrict access to system/helpers/dompdf/load_font.php, or upgrade to a newer version if available.
🔧 Temporary Workarounds
Restrict access to vulnerable file
allBlock web access to the load_font.php file using web server configuration
# For Apache: add to .htaccess
<Files "load_font.php">
Order allow,deny
Deny from all
</Files>
# For Nginx: add to server block
location ~ /load_font\.php$ {
deny all;
return 403;
}
Remove vulnerable file
linuxDelete the vulnerable PHP file from the server
rm -f /path/to/tripexpress/system/helpers/dompdf/load_font.php
🧯 If You Can't Patch
- Implement strict input validation on the src parameter to reject path traversal sequences
- Apply strict file system permissions to limit write access to web directories
🔍 How to Verify
Check if Vulnerable:
Check if tripexpress version is 1.1 and if system/helpers/dompdf/load_font.php exists and is accessible via web requests.Check Version:
Check tripexpress configuration files or documentation for version informationVerify Fix Applied:
Verify load_font.php is no longer accessible via web requests or has been removed from the filesystem.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /system/helpers/dompdf/load_font.php with ../ sequences in parameters
- File write operations in unexpected directories
Network Indicators:
- HTTP POST/GET requests containing path traversal sequences (../, ..\) to the vulnerable endpoint
SIEM Query:
source="web_logs" AND (uri="/system/helpers/dompdf/load_font.php" AND (param="src" AND value="*../*"))