CVE-2023-35840 PoC — elFinder 路径遍历漏洞

Source

Associated Vulnerability

Description

elFinder < 2.1.62 - Path Traversal vulnerability in PHP LocalVolumeDriver connector

Readme

# CVE-2023-35840
elFinder < 2.1.62 - Path Traversal vulnerability in PHP LocalVolumeDriver connector

## Description

Path Traversal vulnerability in PHP LocalVolumeDriver connector. This vulnerability can be exploited by allowing untrusted users to write to the local file system.

Vulnerability exists in `target` parameter which contains a base64 encoded path. For exmpample path `pentest` is encoded as:
```
1_cGVudGVzdA==
```

If we skip `l1_` as it looks to be a constant prefix rest can be decoded as:
```
pentest
```

Therefore we can modify it to:
```
pentest/../../
```

And then encode it as:
```
l1_cGVudGVzdC8uLi8uLi8=
```
With `target` parameter set to this value we can write arbitary files to application root folder.


This issue was caused by incomplete validity checking of the supplied request parameters. That problem has been fixed in elFinder Version 2.1.62.

## Affected versions
< 2.1.62

## Advisory
Update elFinder to 2.1.62 or newer.

### References
* https://github.com/Studio-42/elFinder/security/advisories/GHSA-wm5g-p99q-66g4
* https://nvd.nist.gov/vuln/detail/CVE-2023-35840

File Snapshot

 [4.0K]  /data/pocs/cf314ed0665b061188ccc4078d51b5f99d60ee6e
├── [ 34K]  LICENSE
└── [1.1K]  README.md

0 directories, 2 files

Remarks