ElFinder Vulnerabilities – Security Risks & Fixes

Contents: What is elFinder? Common ElFinder Vulnerabilities & Exploits Additional Security Measures Summary of Fixes

What is elFinder?

elFinder is an open-source web-based file manager written in JavaScript, widely used in CMS platforms, hosting panels, and web applications. However, poor configuration can expose serious security risks.

Common ElFinder Vulnerabilities & Exploits

Unauthorized File Uploads

• Attackers can upload malicious PHP scripts (shell.php), leading to server compromise.
• Some versions of elFinder allow unrestricted file uploads due to missing authentication checks.

Example Exploit:

curl -X POST -F "cmd=upload" -F "target=l1_Lw" -F "upload[]=@shell.php" http://yourdomain.com/elfinder/php/connector.php

Risk: This can lead to remote code execution (RCE).

Fix:

• Restrict upload types in connector.php:

  'uploadAllow' => array('image/png', 'image/jpeg', 'application/pdf'),
  'uploadDeny'  => array('all'),

• Disable direct access to PHP files in upload folders:

  <Directory /var/www/html/elfinder/files>
      <FilesMatch "\.php$">
          Deny from all
      </FilesMatch>
  </Directory>

Authentication Bypass

• Old versions of elFinder (before 2.1.57) allowed unauthorized users to access connector.php, exposing sensitive files.

Example Exploit:

curl http://yourdomain.com/elfinder/php/connector.php?cmd=open

Risk: Anyone can browse your server files.

Fix:

• Enable authentication in connector.php:

  'bind' => array(
      'upload.pre' => array(
          'Plugin.Sanitizer.cmdUploadPre',
          'Plugin.Authentication.cmdPre',
      )
  ),

• Restrict access using .htaccess:

  <Files "connector.php">
      Require all denied
  </Files>

Arbitrary File Read (LFI)

• Vulnerable versions allow Local File Inclusion (LFI), exposing config files (wp-config.php, .env, database.php).

Example Exploit:

curl "http://yourdomain.com/elfinder/php/connector.php?cmd=file&target=l1_L2NvbmZpZy5waHA"

Risk: Attackers can steal database credentials.

Fix:

• Disable direct file access:

  <FilesMatch "(config\.php|\.env|database\.php)">
      Require all denied
  </FilesMatch>

• Upgrade to the latest elFinder version.

Cross-Site Scripting (XSS)

• If filenames are not sanitized, attackers can inject JavaScript.

Example Exploit:

curl -X POST -F "cmd=rename" -F "target=l1_test.txt" -F "name=<script>alert('XSS')</script>" http://yourdomain.com/elfinder/php/connector.php

Risk: Session hijacking, stealing cookies, redirecting users.

Fix:

• Enable elFinder’s built-in filename sanitizer:

  'plugin' => array(
      'Sanitizer' => array(
          'enable' => true,
          'targets' => array('\\', '/', ':', '*', '?', '"', '<', '>', '|', ' '),
          'replace' => '_'
      )
  )

• Use Content Security Policy (CSP) to prevent execution of injected scripts.

Additional Security Measures

Restrict ElFinder to Authorized Users

• Use Basic Auth for extra security:

  <Directory /var/www/html/elfinder>
      AuthType Basic
      AuthName "Restricted Access"
      AuthUserFile /etc/apache2/.htpasswd
      Require valid-user
  </Directory>

Remove elFinder After Use

• If elFinder is no longer needed, delete it:

  rm -rf /var/www/html/elfinder

Summary of Fixes

Keep elFinder updated & restrict access to prevent exploits!