CVE-2021-32682: Std42 Elfinder RCE Vulnerability

CVE-2021-32682 Overview

elFinder is an open-source file manager for web applications, written in JavaScript using jQuery UI. CVE-2021-32682 encompasses several vulnerabilities affecting elFinder version 2.1.58 that can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. The vulnerabilities stem from improper input validation and path traversal weaknesses in the PHP backend components.

Critical Impact

These vulnerabilities enable unauthenticated remote code execution on servers running vulnerable elFinder installations, potentially leading to complete server compromise.

Affected Products

• std42 elFinder versions prior to 2.1.59
• elFinder PHP connector implementations using vulnerable versions
• Web applications integrating elFinder 2.1.58 and earlier

Discovery Timeline

• 2021-06-14 - CVE-2021-32682 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-32682

Vulnerability Analysis

The vulnerabilities in elFinder 2.1.58 involve multiple security weaknesses in the PHP connector component. The primary issue relates to path traversal (CWE-22) where user-controlled input is not properly sanitized before being used in file system operations. This allows attackers to manipulate file paths and potentially escape the intended directory structure. Combined with command injection vectors in archive handling functionality, attackers can achieve arbitrary code execution on the target server without requiring authentication if the connector is exposed.

The attack surface is particularly concerning because elFinder is designed to be a web-accessible file manager, and many deployments expose the PHP connector endpoint without adequate access controls.

Root Cause

The root cause stems from insufficient input validation and improper handling of file paths in the elFinderVolumeDriver.class.php and elFinderVolumeLocalFileSystem.class.php components. The vulnerable code failed to properly sanitize user-supplied path information before using it in error messages and file operations, creating opportunities for path traversal attacks. Additionally, the quarantine folder mechanism used for archive inspection was vulnerable to exploitation.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. Attackers can send specially crafted requests to the elFinder PHP connector endpoint to exploit the path traversal and command injection vulnerabilities. The archive command injection vector allows attackers to inject malicious commands during archive extraction operations, while the path traversal weakness enables access to files outside the intended web root.

// Patch showing the fix for path disclosure in error handling
// Source: https://github.com/Studio-42/elFinder/commit/a106c350b7dfe666a81d6b576816db9fe0899b17
         $stat = $this->stat($path);
 
         if (empty($stat)) {
-            return $this->setError(elFinder::ERROR_RM, $path, elFinder::ERROR_FILE_NOT_FOUND);
+            return $this->setError(elFinder::ERROR_RM, $this->relpathCE($path), elFinder::ERROR_FILE_NOT_FOUND);
         }
 
         $stat['realpath'] = $path;

// Patch removing the vulnerable quarantine folder configuration
// Source: https://github.com/Studio-42/elFinder/commit/a106c350b7dfe666a81d6b576816db9fe0899b17
         $this->options['alias'] = '';              // alias to replace root dir name
         $this->options['dirMode'] = 0755;            // new dirs mode
         $this->options['fileMode'] = 0644;            // new files mode
-        $this->options['quarantine'] = '.quarantine'; // quarantine folder name - required to check archive (must be hidden)
         $this->options['rootCssClass'] = 'elfinder-navbar-root-local';
         $this->options['followSymLinks'] = true;
         $this->options['detectDirIcon'] = '';         // file name that is detected as a folder icon e.g. '.diricon.png'

Detection Methods for CVE-2021-32682

Indicators of Compromise

• Unusual HTTP requests to elFinder connector endpoints containing path traversal sequences (../)
• Archive files with embedded command injection payloads being uploaded or processed
• Unexpected process spawning from web server processes after elFinder operations
• Web server error logs showing file access attempts outside the configured root directory

Detection Strategies

• Monitor web application firewall (WAF) logs for path traversal patterns targeting elFinder connector URLs
• Implement file integrity monitoring on the elFinder installation directory
• Review web server access logs for suspicious requests to connector.php or similar elFinder endpoints
• Deploy endpoint detection rules to identify command execution originating from PHP processes

Monitoring Recommendations

• Enable detailed logging for the elFinder PHP connector to capture all file operation requests
• Configure alerts for any archive extraction operations, particularly with unusual file names
• Monitor for new file creation in unexpected directories relative to the elFinder root
• Implement network traffic analysis to detect potential exploitation attempts against elFinder endpoints

How to Mitigate CVE-2021-32682

Immediate Actions Required

• Upgrade elFinder to version 2.1.59 or later immediately
• Ensure the elFinder connector is not exposed without proper authentication
• Review web server configurations to restrict access to the connector endpoint
• Audit existing elFinder deployments for signs of compromise

Patch Information

The vulnerabilities were patched in elFinder version 2.1.59. The security fix addresses the path traversal issue by implementing proper path sanitization using the relpathCE() function in error messages and removing the vulnerable quarantine folder configuration. The patch is available via the official GitHub commit. For detailed technical analysis, refer to the SonarSource vulnerability case study and the GitHub Security Advisory.

Workarounds

• Implement authentication requirements for all elFinder connector endpoints
• Use a web application firewall to block requests containing path traversal sequences
• Restrict network access to the elFinder connector to trusted IP addresses only
• Disable archive handling functionality if not required for your use case

# Apache configuration to restrict elFinder connector access
<Location /path/to/elfinder/php/connector.php>
    Require ip 192.168.1.0/24
    # Or require valid authentication
    AuthType Basic
    AuthName "elFinder Access"
    AuthUserFile /etc/apache2/.htpasswd
    Require valid-user
</Location>