CVE-2021-43836 PHP file inclusion in the Sulu admin panel

What is CVE-2021-43836?

CVE-2021-43836 is a high-severity path traversal vulnerability in sulu, published on 15 Dec 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions an attacker can read arbitrary local files via a PHP file include. In a default configuration this also leads to remote code execution. The problem is patched with the Versions 1.6.44, 2.2.18, 2.3.8, 2.4.0. For users unable to upgrade overwrite the service `sulu_route.generator.expression_token_provider` and wrap the translator before passing it to the expression language.

Weakness: CWE-22

Which versions are affected by CVE-2021-43836?

8 open source packages ship an affected version, including sulu/sulu. It affects 1 product.

Products include Sulu Sulu.

How do I fix CVE-2021-43836?

Upgrade sulu/sulu to a fixed version for your release line: 1.6.44, 2.2.18, 2.3.8 or 2.4.0.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2021-43836 being exploited?

There is no known exploitation of CVE-2021-43836 in the wild and no public exploit code.

Other vulnerabilities in sulu

• CVE-2021-32737 XSS Injection in Media Collection Title was possible High 8.4
• CVE-2021-43835 Privilege escalation in the Sulu Admin panel High 7.2
• CVE-2024-27915 Sulu grants access to pages regardless of role permissions Medium 6.8
• CVE-2021-41169 Improper Neutralization HTML tags in sulu/sulu Medium 6.2
• CVE-2024-47617 Reflected XSS Vulnerability in Sulu Media Bundle Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vx6j-pjrh-vgjh.