Patchfirst
Patchfirst
CVE-2021-23394 Public exploit High · 8.1 EPSS 18.9%

Remote Code Execution (RCE)

Summary

The studio-42/elfinder package (versions before 2.1.58) contains a flaw that allows execution of PHP code embedded in a .phar file. An unauthenticated remote attacker with no user interaction could achieve remote code execution, but only if the server is configured to parse .phar files as PHP.

Official description · CVE.org

The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP.

Breakdown
65.1 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15

First seen exploited 3 years after disclosure. Public exploit code (PoC-in-GitHub) appeared 4 years after disclosure.

  1. Disclosedday 0
  2. First seen exploitedVulnCheck KEV evidence+3 yrs
  3. Public exploit codePoC-in-GitHub+4 yrs

See the family tree

3 related vulnerabilities in the same code over 2 years. The latest fix listed for studio-42/elfinder is 2.1.61.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. CVE-2019-9194elFinder before 2.1.48 has a command injection vulnerability in…26 Feb 2019
  2. relatedMedium

    Why these are linked:

    This CVECVE-2021-23394Remote Code Execution (RCE)13 Jun 2021
  3. relatedHigh

    Why these are linked:

    CVE-2021-32682Multiple vulnerabilities leading to RCE14 Jun 2021

Fixes in studio-42/elfinderPackagist package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 2.1.45CVE-2019-588410 Jan 2019
  2. 2.1.48CVE-2019-919426 Feb 2019
  3. 2.1.49CVE-2019-625714 Jan 2019
  4. 2.1.58CVE-2021-2339413 Jun 2021
  5. 2.1.59CVE-2021-3268214 Jun 2021
  6. 2.1.60CVE-2021-434217 Apr 2022
  7. 2.1.61CVE-2022-2696021 Mar 2022Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: studio-42/elfinder.

Packagiststudio-42/elfinderGHSA-qm58-cvvm-c5qr

Upgrade to 2.1.59 or later

Fixes this CVE and 2 other known vulnerabilities in this package (CVE-2019-9194, CVE-2021-32682).

Set the version to 2.1.59 or later in your composer.json.

First fixed in 2.1.58 for CVE-2021-23394.

Affected versions

If you runUpgrade to
All versions before 2.1.582.1.59first fix for this CVE: 2.1.58

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

5 links, grouped by NVD tag

x_refsource_MISC 5

snyk.io/vuln/SNYK-PHP-STUDIO42ELFINDER-1290554github.com/Studio-42/elFindergithub.com/Studio-42/elFinder/issues/3295github.com/Studio-42/elFinder/commit/75ea92decc16a5daf7f618f85dc621d1b534b5e1blog.sonarsource.com/elfinder-case-study-of-web-file-manager-vulnerabilities/
↑ ↓ chooseEnter openEsc close