CVE-2021-43421: Studio-42 elFinder RCE Vulnerability

CVE-2021-43421 Overview

CVE-2021-43421 is a critical arbitrary file upload vulnerability affecting Studio-42 elFinder versions 2.0.4 through 2.1.59. The vulnerability exists in the connector.minimal.php file, which allows remote malicious users to upload arbitrary files and execute PHP code on the target server. elFinder is a popular open-source file manager for web applications, making this vulnerability particularly concerning due to its widespread use in content management systems and web applications.

Critical Impact

Remote attackers can exploit this vulnerability to upload malicious PHP files and achieve arbitrary code execution on affected servers without authentication, potentially leading to complete system compromise.

Affected Products

• Studio-42 elFinder versions 2.0.4 to 2.1.59
• Web applications integrating vulnerable elFinder versions
• Content management systems using elFinder as a file manager component

Discovery Timeline

• 2022-04-07 - CVE-2021-43421 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-43421

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The flaw resides in the connector.minimal.php file, which serves as the backend connector for elFinder's file management operations. The vulnerable component fails to properly validate and restrict the types of files that can be uploaded through the web interface.

The attack can be initiated remotely over the network without requiring any authentication or user interaction. An attacker can exploit this vulnerability to upload arbitrary files, including malicious PHP scripts, which can then be executed on the server. This can lead to complete confidentiality, integrity, and availability compromise of the affected system.

Root Cause

The root cause of this vulnerability is insufficient file upload validation in the connector.minimal.php component. The application does not adequately verify file types, extensions, or content before allowing uploads. This lack of proper input validation enables attackers to bypass intended restrictions and upload files with dangerous types such as PHP scripts.

Attack Vector

The attack vector is network-based, requiring no privileges or user interaction. An attacker can craft a malicious HTTP request to the connector.minimal.php endpoint, uploading a PHP webshell or other malicious script. Once uploaded, the attacker can access the uploaded file through the web server, triggering execution of the malicious code.

The exploitation flow typically involves:

1. Identifying an exposed elFinder instance with the vulnerable connector
2. Crafting a multipart HTTP POST request to upload a malicious PHP file
3. Bypassing any client-side file type restrictions
4. Accessing the uploaded PHP file via its URL to execute arbitrary commands
5. Establishing persistent access through webshells or reverse shells

For detailed technical information, refer to the GitHub Issue #3429 documenting this vulnerability.

Detection Methods for CVE-2021-43421

Indicators of Compromise

• Unexpected PHP files appearing in elFinder upload directories
• Web server logs showing POST requests to connector.minimal.php with file upload payloads
• Unusual file extensions being uploaded (e.g., .php, .phtml, .php5)
• Webshell signatures detected in uploaded content
• Anomalous outbound network connections from the web server

Detection Strategies

• Monitor HTTP requests to connector.minimal.php for suspicious file upload patterns
• Implement file integrity monitoring on web directories to detect unauthorized file creation
• Deploy web application firewall (WAF) rules to block PHP file uploads through elFinder endpoints
• Analyze web server access logs for patterns indicating webshell access attempts
• Use endpoint detection and response (EDR) solutions to identify post-exploitation activity

Monitoring Recommendations

• Enable verbose logging on web servers hosting elFinder instances
• Configure alerts for new file creation events in upload directories with executable extensions
• Monitor for unusual process spawning from web server processes
• Implement network traffic analysis to detect command and control communications
• Regularly audit uploaded files for malicious content

How to Mitigate CVE-2021-43421

Immediate Actions Required

• Upgrade elFinder to a patched version beyond 2.1.59 immediately
• Restrict access to connector.minimal.php using web server access controls
• Implement strict file type validation at the server level
• Remove or disable elFinder if not actively required
• Review upload directories for any previously uploaded malicious files

Patch Information

Organizations should update to the latest version of elFinder that addresses this vulnerability. Consult the elFinder GitHub repository for patch details and release notes. After applying patches, verify the fix by testing that PHP file uploads are properly blocked.

Workarounds

• Configure web server to disable PHP execution in elFinder upload directories using .htaccess or server configuration
• Implement a whitelist of allowed file extensions at the application level
• Use a web application firewall to block requests attempting to upload executable files
• Restrict network access to elFinder administrative interfaces to trusted IP addresses only

# Apache configuration to disable PHP execution in upload directory
<Directory "/path/to/elfinder/files">
    php_admin_flag engine off
    <FilesMatch "\.ph(p[3-7]?|tml)$">
        Require all denied
    </FilesMatch>
</Directory>