CVE-2021-23394 Remote Code Execution (RCE)

High 8.1 Published 13 Jun 2021 Updated 16 Sep 2024

Attackers can achieve remote code execution by uploading malicious .phar files if the server is configured to parse them as PHP.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-23394?

CVE-2021-23394 is a high-severity vulnerability in studio-42/elfinder, published on 13 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP.

Weakness: CWE-434

Which versions are affected by CVE-2021-23394?

2 open source packages ship an affected version, including studio-42/elfinder. It affects 1 product.

Package	Affected	Fixed in
`studio-42/elfinder` Packagist	All versions	`2.1.58`
`studio-42/elfinder` Packagist	All versions	`2.1.58`

Products include Std42 Elfinder.

How do I fix CVE-2021-23394?

Upgrade studio-42/elfinder to 2.1.58 or later.

Is CVE-2021-23394 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-23394 exists.

Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.

Sources

Also known as GHSA-qm58-cvvm-c5qr, SNYK-PHP-STUDIO42ELFINDER-1290554.