From Stored XSS to Code Execution using SocEng, BeEF and elFinder CVE-2021-45919

Summary

A stored cross-site scripting vulnerability, tracked as CVE-2021-45919, was identified in elFinder File Manager. The vulnerability can result in the theft of user credentials, tokens, and the ability to execute malicious JavaScript in the user's browser.

Any organization utilizing an out-of-date elFinder component on its web application could be affected. Organizations should note that elFinder can integrate into many web applications such as Django, Drupal, Laravel, Roundcube, Subrion, Symfony, Tiki Wiki, Wordpress, XOOPS, Yii & Zenphoto.

Integrations aren't limited to only those web applications, as organizations could deploy the code as they see fit. As a result, the scope of the impact of the elFinder stored XSS vulnerability is not currently known as organizations could potentially deploy it both as an authenticated or unauthenticated component. Organizations with user-permissions-based elFinder deployments or unauthenticated implementations are at a much higher risk of exploitation. So, software engineers should make a determination about the authentication requirements for their integrations.

We identified the vulnerabilities as part of individual security research, and Subrion's Content Management System's (CMS) use of elFinder led to the discovery of this CVE. This writeup identifies a cross-site scripting vulnerability in an additional elFinder version, leading to the revision of the current CVE.

Shout out to Trustwave SpiderLabs and Sakura Samurai member Higinio Ochoa who bravely volunteered to click my elFinder exploitation link multiple times while troubleshooting for this write-up. Additional hat tip to MLT, 0xFFFF member who told me that Subrion would likely be a good CMS to use for my research..

CVE-2021-45919

Improper neutralization of input during web page generation leads to cross-site scripting in elFinder file manager versions ≤ 2.1.31. A threat actor can store a cross-site scripting payload in an SVG file that executes upon visiting the location of the stored SVG file.

Identification

ElFinder is integrated into the Subrion demo environment. While testing Subrion, an 'Uploads Manager' extension was identified in the 'Content' tab of the 'Admin Dashboard' control panel.

We noticed various file types within the upload manager, and testing indicated that .svg files might not be securely processed. Right-clicking on any of the uploaded files allows the user to click on a button that says 'Get info' which displays the size, path, dimensions, and other elements of the file. The interesting portion was the 'Link' property which provided the path to the location within the application where the uploaded file is stored, allowing direct access to upload files. Direct access to uploaded files makes stored payloads easier to exploit.

By crafting a malicious .svg file, we intended to store a cross-site scripting payload to test the baseline level for exploitation. The following PoC code was utilized: