A high-severity vulnerability affecting elFinder, an open-source file manager, allowing attackers to bypass Server-Side Request Forgery (SSRF) protection when PHP cURL is unavailable and URL uploads use the fsock_get_contents fallback. This enables the upload of files from internal services reachable by the PHP process, potentially disclosing sensitive information. The vulnerability occurs due to a TOCTOU/double DNS resolution without IP pinning issue in the elFinder connector, which can be exploited through an attacker-controlled DNS hostname that initially resolves to an allowed public IP address and subsequently resolves to a loopback or private IP address. This allows the connection to reach an address different from the one that was validated, resulting in a non-blind SSRF. The vulnerability affects elFinder versions 2.1.69 and earlier, with a CVSS score of 8.6 (High) for exposed connectors without authentication requirements. Remediation involves using the IP address returned by validate_address instead of resolving the hostname again for socket connections, while maintaining the original hostname for HTTPS connections to ensure proper certificate validation. Additionally, URL uploads could be rejected when cURL is unavailable as a temporary mitigation.
We recommend you to update elFinder to version 2.1.70.[/subscribe_to_unlock_form]
A high-severity vulnerability affecting elFinder, an open-source file manager, allowing attackers to bypass Server-Side Request Forgery (SSRF) protection when PHP cURL is unavailable and URL uploads use the fsock_get_contents fallback. This enables the upload of files from internal services reachable by the PHP process, potentially disclosing sensitive information. The vulnerability occurs due to a TOCTOU/double DNS resolution without IP pinning issue in the elFinder connector, which can be exploited through an attacker-controlled DNS hostname that initially resolves to an allowed public IP address and subsequently resolves to a loopback or private IP address. This allows the connection to reach an address different from the one that was validated, resulting in a non-blind SSRF. The vulnerability affects elFinder versions 2.1.69 and earlier, with a CVSS score of 8.6 (High) for exposed connectors without authentication requirements. Remediation involves using the IP address returned by validate_address instead of resolving the hostname again for socket connections, while maintaining the original hostname for HTTPS connections to ensure proper certificate validation. Additionally, URL uploads could be rejected when cURL is unavailable as a temporary mitigation.
We recommend you to update elFinder to version 2.1.70.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]