来源

关联漏洞

描述

elFinder < 2.1.62 - Path Traversal vulnerability in PHP LocalVolumeDriver connector

介绍

# CVE-2023-35840
elFinder < 2.1.62 - Path Traversal vulnerability in PHP LocalVolumeDriver connector

## Description

Path Traversal vulnerability in PHP LocalVolumeDriver connector. This vulnerability can be exploited by allowing untrusted users to write to the local file system.

Vulnerability exists in `target` parameter which contains a base64 encoded path. For exmpample path `pentest` is encoded as:
```
1_cGVudGVzdA==
```

If we skip `l1_` as it looks to be a constant prefix rest can be decoded as:
```
pentest
```

Therefore we can modify it to:
```
pentest/../../
```

And then encode it as:
```
l1_cGVudGVzdC8uLi8uLi8=
```
With `target` parameter set to this value we can write arbitary files to application root folder.


This issue was caused by incomplete validity checking of the supplied request parameters. That problem has been fixed in elFinder Version 2.1.62.

## Affected versions
< 2.1.62

## Advisory
Update elFinder to 2.1.62 or newer.

### References
* https://github.com/Studio-42/elFinder/security/advisories/GHSA-wm5g-p99q-66g4
* https://nvd.nist.gov/vuln/detail/CVE-2023-35840

文件快照

 [4.0K]  /data/pocs/cf314ed0665b061188ccc4078d51b5f99d60ee6e
├── [ 34K]  LICENSE
└── [1.1K]  README.md

0 directories, 2 files

备注