CVE-2023-54335
📋 TL;DR
eXtplorer 2.1.14 contains an authentication bypass vulnerability that allows attackers to login without valid credentials by manipulating login requests. This enables attackers to upload malicious PHP files and execute arbitrary commands on the vulnerable file management system. Organizations using eXtplorer 2.1.14 for web-based file management are affected.
💻 Affected Systems
- eXtplorer
📦 What is this software?
Extplorer by Extplorer
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution, data theft, and potential lateral movement within the network.
Likely Case
Unauthorized file upload leading to web shell deployment and subsequent command execution on the web server.
If Mitigated
Limited impact with proper network segmentation, web application firewalls, and file upload restrictions.
🎯 Exploit Status
Public exploit code available on Exploit-DB (ID 51067) with simple HTTP request manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.15 or later
Vendor Advisory: https://extplorer.net/
Restart Required: No
Instructions:
1. Download latest version from extplorer.net 2. Backup current installation 3. Replace files with patched version 4. Verify authentication works correctly
🔧 Temporary Workarounds
Disable eXtplorer
linuxTemporarily disable the eXtplorer application until patching is complete.
mv /path/to/extplorer /path/to/extplorer.disabled
Restrict Access
linuxUse firewall rules to restrict access to eXtplorer only from trusted IP addresses.
iptables -A INPUT -p tcp --dport 80 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate eXtplorer from critical systems
- Deploy web application firewall with authentication bypass detection rules
🔍 How to Verify
Check if Vulnerable:
Check version in includes/header.php or try authentication bypass with modified login request.Check Version:
grep '\$version' /path/to/extplorer/includes/header.phpVerify Fix Applied:
Attempt authentication bypass with modified login request - should fail with proper authentication required.📡 Detection & Monitoring
Log Indicators:
- Unusual login patterns
- Successful logins without password validation
- PHP file uploads to upload directory
Network Indicators:
- HTTP POST requests to login.php with manipulated parameters
- Unexpected file uploads to eXtplorer
SIEM Query:
source="web.log" (uri="/login.php" AND method="POST" AND (param_contains("password","") OR param_missing("password")))