ElFinder Vulnerabilities — Security Risks & Fixes

What is elFinder?

elFinder is an open-source web-based file manager written in JavaScript, widely used in CMS platforms, hosting panels, and web applications. However, poor configuration can expose serious security risks.

For the specific XSS variant and related CMS-security topics, see ElFinder Cross-Site Scripting (XSS) Vulnerability, CVE-2014-3704 — Drupalgeddon Patch, and CVE-2014-3704 Technical Analysis.

Common ElFinder Vulnerabilities & Exploits

Unauthorized File Uploads

• Attackers can upload malicious PHP scripts (shell.php), leading to server compromise.
• Some versions of elFinder allow unrestricted file uploads due to missing authentication checks.

Example Exploit:

curl -X POST -F "cmd=upload" -F "target=l1_Lw" -F "upload[]=@shell.php" http://yourdomain.com/elfinder/php/connector.php

Risk: This can lead to remote code execution (RCE).

Fix:

• Restrict upload types in connector.php:

  'uploadAllow' => array('image/png', 'image/jpeg', 'application/pdf'),
  'uploadDeny'  => array('all'),

• Disable direct access to PHP files in upload folders:

  <Directory /var/www/html/elfinder/files>
      <FilesMatch "\.php$">
          Deny from all
      </FilesMatch>
  </Directory>

Authentication Bypass

• Old versions of elFinder (before 2.1.57) allowed unauthorized users to access connector.php, exposing sensitive files.

Example Exploit:

curl http://yourdomain.com/elfinder/php/connector.php?cmd=open

Risk: Anyone can browse your server files.

Fix:

• Enable authentication in connector.php:

  'bind' => array(
      'upload.pre' => array(
          'Plugin.Sanitizer.cmdUploadPre',
          'Plugin.Authentication.cmdPre',
      )
  ),

• Restrict access using .htaccess:

  <Files "connector.php">
      Require all denied
  </Files>

Arbitrary File Read (LFI)

• Vulnerable versions allow Local File Inclusion (LFI), exposing config files (wp-config.php, .env, database.php).

Example Exploit:

curl "http://yourdomain.com/elfinder/php/connector.php?cmd=file&target=l1_L2NvbmZpZy5waHA"

Risk: Attackers can steal database credentials.

Fix:

• Disable direct file access:

  <FilesMatch "(config\.php|\.env|database\.php)">
      Require all denied
  </FilesMatch>

• Upgrade to the latest elFinder version.

Cross-Site Scripting (XSS)

• If filenames are not sanitized, attackers can inject JavaScript.

Example Exploit:

curl -X POST -F "cmd=rename" -F "target=l1_test.txt" -F "name=<script>alert('XSS')</script>" http://yourdomain.com/elfinder/php/connector.php

Risk: Session hijacking, stealing cookies, redirecting users.

Fix:

• Enable elFinder?s built-in filename sanitizer:

  'plugin' => array(
      'Sanitizer' => array(
          'enable' => true,
          'targets' => array('\\', '/', ':', '*', '?', '"', '<', '>', '|', ' '),
          'replace' => '_'
      )
  )

• Use Content Security Policy (CSP) to prevent execution of injected scripts.

Additional Security Measures

Restrict ElFinder to Authorized Users

• Use Basic Auth for extra security:

  <Directory /var/www/html/elfinder>
      AuthType Basic
      AuthName "Restricted Access"
      AuthUserFile /etc/apache2/.htpasswd
      Require valid-user
  </Directory>

Remove elFinder After Use

• If elFinder is no longer needed, delete it:

  rm -rf /var/www/html/elfinder

Summary of Fixes

Keep elFinder updated & restrict access to prevent exploits!