LevelBlue Named Official Cybersecurity Advisor of the PGA of America. Learn more

Request a Demo

LevelBlue Named Official Cybersecurity Advisor of the PGA of America. Learn more

Submit RFP
Request a Demo
Services
Cyber Advisory
Managed Cloud Security
Data Security
Managed Detection & Response
Email Security
Managed Network Infrastructure Security
Exposure Management
Security Operations Platforms
Incident Readiness & Response
SpiderLabs Threat Intelligence
View All Services
Solutions
BY INDUSTRY
BY REGULATION
BY TOPIC
Offensive Security
Solutions to maximize your security ROI
Operational Technology
End-to-end OT security
Microsoft Security
Unlock the full power of Microsoft Security
Securing the IoT Landscape
Test, monitor and secure network objects
Why LevelBlue
About Us
We reduce cyber risk and build resilience
Awards and Accolades
The most recognized cybersecurity leader
LevelBlue SpiderLabs
Elite global threat experts and intelligence
PGA of America Partnership
Cybersecurity at the championship level
Secure What's Next
Future-proof your organization
LevelBlue Security Operations Platforms
Unprecedented security visibility and control
Security Colony
Cybersecurity threat protection resources
Partners
Microsoft
Unlock the full power of Microsoft Security
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Register
Login
Resources
BLOGS
UPCOMING
MEDIA & ASSETS
NOTICES
HELP

From Stored XSS to Code Execution using SocEng, BeEF and elFinder CVE-2021-45919

Change theme to light
6 Minute Read by John Jackson

Summary

A stored cross-site scripting vulnerability, tracked as CVE-2021-45919, was identified in elFinder File Manager. The vulnerability can result in the theft of user credentials, tokens, and the ability to execute malicious JavaScript in the user's browser.

Any organization utilizing an out-of-date elFinder component on its web application could be affected. Organizations should note that elFinder can integrate into many web applications such as Django, Drupal, Laravel, Roundcube, Subrion, Symfony, Tiki Wiki, Wordpress, XOOPS, Yii & Zenphoto.

Integrations aren't limited to only those web applications, as organizations could deploy the code as they see fit. As a result, the scope of the impact of the elFinder stored XSS vulnerability is not currently known as organizations could potentially deploy it both as an authenticated or unauthenticated component. Organizations with user-permissions-based elFinder deployments or unauthenticated implementations are at a much higher risk of exploitation. So, software engineers should make a determination about the authentication requirements for their integrations.

We identified the vulnerabilities as part of individual security research, and Subrion's Content Management System's (CMS) use of elFinder led to the discovery of this CVE. This writeup identifies a cross-site scripting vulnerability in an additional elFinder version, leading to the revision of the current CVE.

Shout out to Trustwave SpiderLabs and Sakura Samurai member Higinio Ochoa who bravely volunteered to click my elFinder exploitation link multiple times while troubleshooting for this write-up. Additional hat tip to MLT, 0xFFFF member who told me that Subrion would likely be a good CMS to use for my research..

CVE-2021-45919

Improper neutralization of input during web page generation leads to cross-site scripting in elFinder file manager versions ≤ 2.1.31. A threat actor can store a cross-site scripting payload in an SVG file that executes upon visiting the location of the stored SVG file.

Identification

ElFinder is integrated into the Subrion demo environment. While testing Subrion, an 'Uploads Manager' extension was identified in the 'Content' tab of the 'Admin Dashboard' control panel.

 

Image001


We noticed various file types within the upload manager, and testing indicated that .svg files might not be securely processed. Right-clicking on any of the uploaded files allows the user to click on a button that says 'Get info' which displays the size, path, dimensions, and other elements of the file. The interesting portion was the 'Link' property which provided the path to the location within the application where the uploaded file is stored, allowing direct access to upload files. Direct access to uploaded files makes stored payloads easier to exploit.

By crafting a malicious .svg file, we intended to store a cross-site scripting payload to test the baseline level for exploitation. The following PoC code was utilized: