ElFinder Cross-Site Scripting (XSS) Vulnerability — Exploits & Fixes

For related CMS-security topics, see CVE-2014-3704 — Emergency Security Patch for Drupal (Drupalgeddon), BlacklistAlert — Understanding and Resolving, and assert_quiet_eval in PHP — Explanation & Troubleshooting.

What is an XSS Vulnerability in elFinder?

Cross-Site Scripting (XSS) in elFinder occurs when user input is not properly sanitized, allowing attackers to inject malicious JavaScript into file names, metadata, or responses.

Potential Risks of XSS in elFinder:

• Stealing session cookies (document.cookie hijacking).
• Redirecting users to phishing pages.
• Executing malicious scripts in the victim's browser.

Exploiting elFinder XSS (For Testing)

Example Attack: XSS via Filename Manipulation

An attacker uploads a file with an XSS payload as its name:

Attack Payload:

curl -X POST -F "cmd=rename" -F "target=l1_test.txt" -F "name=<script>alert('XSS')</script>" http://yourdomain.com/elfinder/php/connector.php

If the system is not sanitizing filenames, this script executes when a user views the file list.

Example Attack: XSS via File URL

If elFinder allows unrestricted access to stored files, an attacker can craft a malicious URL:

http://yourdomain.com/elfinder/files/<script>alert('XSS')</script>.jpg

If Content-Disposition headers are missing, the file may execute instead of downloading.

Stored XSS via JSON Response

Some versions of elFinder return unsanitized JSON responses, allowing JavaScript injection:

Exploit:

curl "http://yourdomain.com/elfinder/php/connector.php?cmd=open&target=l1_Lw<script>alert('XSS')</script>"

This will inject JavaScript into elFinder's file manager interface.

Fixing XSS Vulnerabilities in elFinder

Enable elFinder's Built-in Filename Sanitization

Edit connector.php and sanitize filenames:

'plugin' => array(
    'Sanitizer' => array(
        'enable' => true,
        'targets' => array('\\', '/', ':', '*', '?', '"', '<', '>', '|', ' '), 
        'replace' => '_'
    )
)

This replaces dangerous characters with underscores (_).

Sanitize User Input in PHP

Modify connector.php to ensure all input is properly sanitized:

if (isset($_GET['cmd'])) {
    $_GET['cmd'] = htmlspecialchars($_GET['cmd'], ENT_QUOTES, 'UTF-8');
}
if (isset($_GET['target'])) {
    $_GET['target'] = htmlspecialchars($_GET['target'], ENT_QUOTES, 'UTF-8');
}

This prevents script injection through GET parameters.

Use Content Security Policy (CSP)

To block inline JavaScript execution, add this to Apache's .htaccess or Nginx config:

Header always set Content-Security-Policy "default-src 'self'; script-src 'self'"

This blocks any scripts from running outside your server.

Restrict File Uploads to Safe Types

Limit upload types in connector.php:

'uploadAllow' => array('image/png', 'image/jpeg', 'application/pdf'),
'uploadDeny'  => array('all'),

This prevents uploading malicious JavaScript disguised as .html, .svg, or .php files.

Force File Downloads Instead of Execution

Add the following .htaccess rules in elfinder/files/:

<FilesMatch "\.(html|js|svg|json|php)$">
    ForceType application/octet-stream
    Header set Content-Disposition attachment
</FilesMatch>

This ensures files download instead of executing in the browser.

Summary of Fixes

XSS Vulnerability	Fix
Filename XSS	Enable filename sanitization (Sanitizer plugin)
URL-based XSS	Use .htaccess to force downloads
JSON Response XSS	Sanitize $_GET input in connector.php
Stored XSS in Metadata	Use htmlspecialchars() to escape inputs
Prevent inline script execution	Use Content Security Policy (CSP)

Now elFinder is protected against XSS attacks!