CVE-2021-32682 Multiple vulnerabilities leading to RCE

What is CVE-2021-32682?

CVE-2021-32682 is a critical command injection vulnerability in Studio-42 elFinder, published on 14 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. The issues were patched in version 2.1.59. As a workaround, ensure the connector is not exposed without authentication.

Weakness: CWE-918, CWE-78, CWE-22

Which versions are affected by CVE-2021-32682?

2 open source packages ship an affected version, including studio-42/elfinder. It affects 1 product.

Products include Std42 Elfinder.

How do I fix CVE-2021-32682?

Upgrade studio-42/elfinder to 2.1.59 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2021-32682 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-32682 exists.

Public exploit code: 1 Metasploit module and 1 Nuclei template.

Other vulnerabilities in Studio-42 elFinder

• CVE-2023-52044 File upload in n/a Critical 9.8
• CVE-2024-38909 Studio 42 elFinder vulnerable to Incorrect Access Control Critical 9.8
• CVE-2022-27115 RCE in Studio-42 elFinder on Windows before 2.1.61 Critical 9.8
• CVE-2021-43421 elFinder Unrestricted File Upload vulnerability Critical 9.8
• CVE-2019-9194 elFinder command injection vulnerability in the PHP connector Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wph3-44rj-92pr.