CVE-2021-32682: elFinder before 2.1.59 contains multiple vulnerabilities leading to RCE
Impact
We recently fixed several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with the minimal configuration.
Patches
The issues were addressed in our last release, 2.1.59.
Workarounds
If you can't update to 2.1.59, make sure your connector is not exposed without authentication.
Reference
Further technical details will be disclosed on https://blog.sonarsource.com/tag/security after some time.
For more information
If you have any questions or comments about this advisory, you can contact: - The original reporters, by sending an email to vulnerability.research@sonarsource.com; - The maintainers, by opening an issue on this repository.
Other sources
elFinder before 2.1.59 contains multiple vulnerabilities leading to RCE
— Packagist
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. The issues were patched in version 2.1.59. As a workaround, ensure the connector is not exposed without authentication.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/studio-42/elfinderto a version that resolves this vulnerability.Fixed in 2.1.59 - Upgrade
Upgrade
elFinderto a version that resolves this vulnerability.Fixed in 2.1.59 - Compensating control
Ensure the elFinder PHP connector is not exposed without authentication.
Event History
Frequently Asked Questions
What is the severity of CVE-2021-32682?
CVE-2021-32682 has a high severity rating due to its potential to allow remote code execution.
How do I fix CVE-2021-32682?
To fix CVE-2021-32682, upgrade your elFinder installation to version 2.1.59 or later.
Which versions of elFinder are affected by CVE-2021-32682?
CVE-2021-32682 affects elFinder versions prior to 2.1.59.
What can an attacker do with CVE-2021-32682?
An attacker can execute arbitrary code and commands on the server hosting the elFinder PHP connector.
Is CVS-2021-32682 related to other vulnerabilities?
CVE-2021-32682 is part of a broader set of vulnerabilities identified in elFinder that impact its security posture.