CVE-2024-21546: Laravel FileManager RCE Vulnerability

CVE-2024-21546 Overview

CVE-2024-21546 is a Remote Code Execution (RCE) vulnerability affecting the UniSharp Laravel-Filemanager package before version 2.9.1. The vulnerability allows attackers to execute malicious code by uploading a file with a valid MIME type while inserting a dot (.) character after the .php file extension. This technique bypasses file extension validation, enabling the execution of arbitrary PHP code on the server.

Critical Impact

Successful exploitation allows remote attackers to execute arbitrary code on affected servers, potentially leading to complete system compromise, data theft, and lateral movement within the network.

Affected Products

• UniSharp Laravel-Filemanager versions prior to 2.9.1
• Laravel applications implementing the vulnerable file manager package
• Web servers hosting applications with the unpatched package

Discovery Timeline

• 2024-12-18 - CVE-2024-21546 published to NVD
• 2025-08-26 - Last updated in NVD database

Technical Details for CVE-2024-21546

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code, or Code Injection). The Laravel-Filemanager package fails to properly sanitize file extensions during the upload process. Specifically, the validation logic does not account for special characters such as the dot (.) character being appended after legitimate PHP file extensions.

When a malicious actor uploads a file with an extension like malicious.php. and provides a valid MIME type, the server processes the file and stores it with executable permissions. Depending on server configuration, the trailing dot may be ignored during execution, causing the web server to interpret the file as PHP code and execute its contents.

The attack is network-accessible and requires no authentication or user interaction, making it particularly dangerous for publicly exposed Laravel applications using this file management package.

Root Cause

The root cause lies in insufficient input validation within the file upload handling mechanism. The original implementation validated MIME types but failed to properly sanitize or reject file extensions containing special characters. This allowed attackers to craft filenames that passed MIME type checks while still being executable as PHP files.

Attack Vector

The attack leverages the network-accessible file upload functionality in Laravel-Filemanager. An attacker crafts a malicious PHP file and renames it with an extension containing a trailing dot (e.g., shell.php.). By setting a valid MIME type in the HTTP request, the file bypasses extension validation. Once uploaded to the server, the PHP interpreter may execute the file, allowing arbitrary code execution under the web server's user context.

The security patch introduces proper extension validation by adding an InvalidExtensionException class that rejects file extensions containing special characters:

<?php

namespace UniSharp\LaravelFilemanager\Exceptions;

class InvalidExtensionException extends \Exception
{
    public function __construct()
    {
        $this->message = 'File extension is not valid.';
    }
}

Source: GitHub Commit

The patch also updates the LfmUploadValidator.php to use this new exception for proper validation:

use UniSharp\LaravelFilemanager\Exceptions\FileFailedToUploadException;
use UniSharp\LaravelFilemanager\Exceptions\FileSizeExceedConfigurationMaximumException;
use UniSharp\LaravelFilemanager\Exceptions\FileSizeExceedIniMaximumException;
use UniSharp\LaravelFilemanager\Exceptions\InvalidExtensionException;
use UniSharp\LaravelFilemanager\Exceptions\InvalidMimeTypeException;
use UniSharp\LaravelFilemanager\LfmPath;

Source: GitHub Commit

Detection Methods for CVE-2024-21546

Indicators of Compromise

• Presence of PHP files with unusual extensions containing trailing dots or special characters in upload directories
• Web server logs showing POST requests to Laravel-Filemanager upload endpoints with suspicious filenames
• Unexpected PHP files in the public/uploads or configured storage directories
• Web shell activity or unauthorized command execution from the web server user account

Detection Strategies

• Monitor file upload endpoints for requests containing filenames with special characters after .php extensions
• Implement file integrity monitoring (FIM) on upload directories to detect unauthorized PHP files
• Configure web application firewall (WAF) rules to block uploads with suspicious file extension patterns
• Review web server access logs for anomalous POST requests to /laravel-filemanager/ routes

Monitoring Recommendations

• Enable verbose logging for the Laravel-Filemanager package and monitor for upload validation failures
• Set up alerts for any new PHP files created in upload directories
• Deploy endpoint detection and response (EDR) solutions to monitor for web shell behavior
• Implement network traffic analysis to detect potential command-and-control communications from compromised servers

How to Mitigate CVE-2024-21546

Immediate Actions Required

• Upgrade UniSharp Laravel-Filemanager to version 2.9.1 or later immediately
• Review upload directories for any suspicious PHP files and remove unauthorized content
• Audit web server logs for evidence of exploitation attempts
• Consider temporarily disabling file upload functionality until patching is complete

Patch Information

The vulnerability has been addressed in Laravel-Filemanager version 2.9.1. The security fix introduces the InvalidExtensionException class and updates the upload validator to reject file extensions containing special characters. The patch is available through the GitHub commit and can be applied by updating the package via Composer. Additional technical details are available in the Snyk Vulnerability Report.

Workarounds

• Configure web server rules to prevent execution of PHP files in upload directories using .htaccess or nginx configuration
• Implement additional server-side validation to reject files with extensions containing special characters
• Restrict file upload functionality to authenticated and authorized users only
• Store uploaded files outside the web root to prevent direct execution

# Nginx configuration to prevent PHP execution in upload directories
location ~* /uploads/.*\.php$ {
    deny all;
    return 403;
}

# Apache .htaccess rule for upload directories
# Add to your uploads directory
# php_flag engine off
# AddHandler default-handler .php