GHSA-wph3-44rj-92pr — elFinder before 2.1.59 contains multiple vulnerabilities leading to RCE

The advisory, in context

Impact

We recently fixed several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with the minimal configuration.

Patches

The issues were addressed in our last release, 2.1.59.

Workarounds

If you can't update to 2.1.59, make sure your connector is not exposed without authentication.

Reference

Further technical details will be disclosed on https://blog.sonarsource.com/tag/security after some time.

For more information

If you have any questions or comments about this advisory, you can contact: - The original reporters, by sending an email to vulnerability.research@sonarsource.com; - The maintainers, by opening an issue on this repository.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

studio-42/elfinder Packagist

Ecosystem versions

Earlier releases before 2.1.59

Fixed in 2.1.59

66 explicitly affected versions

2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.1.0, 2.1.1, 2.1.10, 2.1.11, 2.1.12, 2.1.13, 2.1.14, 2.1.15, 2.1.16, 2.1.17, 2.1.18, 2.1.19, 2.1.2, 2.1.20, 2.1.21, 2.1.22, 2.1.23, 2.1.24, 2.1.25, 2.1.26, 2.1.27, 2.1.28, 2.1.29, 2.1.3, 2.1.30, 2.1.31, 2.1.32, 2.1.33, 2.1.34, 2.1.35, 2.1.36, 2.1.37, 2.1.38, 2.1.39, 2.1.4, 2.1.40, 2.1.41, 2.1.42, 2.1.43, 2.1.44, 2.1.45, 2.1.46, 2.1.47, 2.1.48, 2.1.49, 2.1.5, 2.1.50, 2.1.51, 2.1.52, 2.1.53, 2.1.54, 2.1.55, 2.1.56, 2.1.57, 2.1.58, 2.1.6, 2.1.7, 2.1.8, 2.1.9

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "2.1.59"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "2.0.3",
    "2.0.4",
    "2.0.5",
    "2.0.6",
    "2.0.7",
    "2.0.8",
    "2.0.9",
    "2.1.0",
    "2.1.1",
    "2.1.10",
    "2.1.11",
    "2.1.12",
    "2.1.13",
    "2.1.14",
    "2.1.15",
    "2.1.16",
    "2.1.17",
    "2.1.18",
    "2.1.19",
    "2.1.2",
    "2.1.20",
    "2.1.21",
    "2.1.22",
    "2.1.23",
    "2.1.24",
    "2.1.25",
    "2.1.26",
    "2.1.27",
    "2.1.28",
    "2.1.29",
    "2.1.3",
    "2.1.30",
    "2.1.31",
    "2.1.32",
    "2.1.33",
    "2.1.34",
    "2.1.35",
    "2.1.36",
    "2.1.37",
    "2.1.38",
    "2.1.39",
    "2.1.4",
    "2.1.40",
    "2.1.41",
    "2.1.42",
    "2.1.43",
    "2.1.44",
    "2.1.45",
    "2.1.46",
    "2.1.47",
    "2.1.48",
    "2.1.49",
    "2.1.5",
    "2.1.50",
    "2.1.51",
    "2.1.52",
    "2.1.53",
    "2.1.54",
    "2.1.55",
    "2.1.56",
    "2.1.57",
    "2.1.58",
    "2.1.6",
    "2.1.7",
    "2.1.8",
    "2.1.9"
  ]
}

Set up in your agent.

Investigate in your agent.

elFinder before 2.1.59 contains multiple vulnerabilities leading to RCE