CVE-2021-43836

Executive Summary

CVE-2021-43836 is a critical file inclusion vulnerability in the Sulu content management system (CMS), an open-source PHP platform built on the Symfony framework. The flaw enables an authenticated attacker to read arbitrary local files via a PHP file include, and in a default configuration, this can be escalated to full remote code execution (RCE). This CVE was assigned a CVSS score of 8.5, indicating high severity. The vulnerability has been patched in versions 1.6.44, 2.2.18, 2.3.8, and 2.4.0, and a configuration workaround is available for users unable to upgrade. No CISA KEV listing or confirmed in-the-wild exploitation has been recorded to date, though the underlying vulnerability class presents significant risk given the default-configuration RCE potential.

Technical Analysis

Sulu is an open-source PHP content management system built on the Symfony framework. The vulnerability centers on an unsafe PHP file inclusion mechanism accessible through the Sulu admin panel. The CNA title identifies the issue as "PHP file inclusion in the Sulu admin panel," and the NVD description confirms that an attacker can read arbitrary local files through this inclusion vector.

The vulnerable component is the route generator subsystem, specifically the service sulu_route.generator.expression_token_provider. This service uses an expression language to evaluate route patterns. The expression language is passed a translator object to facilitate localization of route segments. The vulnerability arises because user-controlled input can influence the expression evaluation, and the translator object is passed to the expression language in a manner that allows a dangerous file include operation.

The issue is that the expression language evaluation context includes an object that can be abused to trigger PHP file inclusion. In a default configuration, this file inclusion is not limited in scope, meaning an attacker can not only read arbitrary files from the local file system but also potentially include files that contain executable PHP code. This leads to remote code execution when the included file is processed by the PHP interpreter.

The workaround provided by the vendor is to overwrite the sulu_route.generator.expression_token_provider service and properly wrap the translator before passing it to the expression language. This indicates the core problem is insufficient sanitization or isolation of the translator object within the expression evaluation context.

The vulnerability is server-side and requires access to the Sulu admin panel, which implies the attacker needs at least low-privileged authentication. However, the CVSS vector with an attack complexity of Low and no user interaction requirement indicates that exploitation, once the admin panel is reachable, is straightforward.

Exploitation Scenarios

The attack chain for CVE-2021-43836 proceeds through the following stages. Insufficient technical detail is available in the public description to enumerate exact HTTP endpoints or parameter names; the scenario below is described at the vulnerability-class level.

Step 1: Reconnaissance / Target Identification. An attacker identifies a Sulu CMS instance exposed to the internet. This can be accomplished through metadata fingerprinting — Sulu-based sites may expose identifiable headers, admin panel paths, or generator meta tags. The attacker targets the Sulu admin panel (/admin or a similar path is typical in Symfony-based admin panels, but this is not confirmed in the CVE description). Authentication is required, so the attacker either obtains valid low-privileged credentials via phishing, credential stuffing, or brute force, or finds a decoupled vector to reach the vulnerable component.

Step 2: Triggering the Flaw. Once authenticated to the admin panel, the attacker interacts with the route generation functionality. The vulnerability is a PHP file inclusion flaw. The attacker crafts a malicious expression or route pattern that, when evaluated by the expression language engine, causes the server to include an arbitrary local file. The file path is attacker-controlled. This is triggered through a request that reaches the sulu_route.generator.expression_token_provider service.

Step 3: Payload / Execution Method. At the vulnerability-class level (PHP file inclusion, CWE-98), the attacker supplies a file path as part of the input to the expression evaluation. For arbitrary file disclosure, the attacker reads sensitive local files such as /etc/passwd, web server configuration files, or application configuration files containing database credentials. For remote code execution, the attacker can include a file that contains PHP code (e.g., a log file polluted with PHP payloads, a crafted session file, or an uploaded file) which the PHP interpreter then executes with the privileges of the web server process.

Step 4: Post-Exploitation Impact. A successful exploit grants the attacker:

• Arbitrary file read, enabling credential theft, source code disclosure, and reconnaissance of the server environment.
• Remote code execution (in default configurations), allowing the attacker to spawn a web shell, elevate privileges, move laterally across the network, or exfiltrate sensitive data.

No public PoC is available for this vulnerability. The attack chain is inferred from the vulnerability class (PHP file inclusion) and the component identified in the NVD description. Actual exploitation details may vary depending on Sulu's internal routing implementation and the precise expression evaluation flow, which is not publicly documented at the level required for a step-by-step exploit write-up.

Impact Assessment

The CVSS score of 8.5 (High) with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates the following:

• Attack Vector: Network — The vulnerability is exploitable remotely.
• Attack Complexity: Low — No special conditions or race conditions are required.
• Privileges Required: Low — The attacker only needs low-privileged access (standard authenticated user to the admin panel), not administrative rights.
• User Interaction: None — No victim interaction is needed.
• Scope: Unchanged — The impact is limited to the vulnerable component.
• Confidentiality: High — Arbitrary local file read enables full disclosure of sensitive data.
• Integrity: High — Remote code execution allows modification of server resources.
• Availability: High — RCE can be used to disrupt services or completely compromise the host.

Affected Systems: All Sulu CMS instances running versions prior to 1.6.44, 2.2.18, 2.3.8, and 2.4.0. This includes production sites, staging environments, and any deployment where the Sulu admin panel is accessible. The EPSS score of 0.01981 (78.6th percentile) suggests a moderate-to-high likelihood of exploitation in the wild among known CVEs.

Blast Radius: Since Sulu is a CMS, affected organizations may include media companies, public-sector entities, and enterprises using Sulu for their web presence. The administrative panel being the attack surface means the blast radius is limited to organizations that expose the admin panel, but the consequences of RCE on a CMS server include website defacement, data theft, and using the compromised server as a pivot point for deeper network intrusion.

Detection Guidance

Sigma Rule

title: Sulu CMS PHP File Inclusion Attempt (CVE-2021-43836)
id: 5e1d2a09-18bd-4e16-9f6c-8e02a45c4a13
status: experimental
description: Detects potential exploitation attempts of CVE-2021-43836, a PHP file inclusion vulnerability in Sulu CMS admin panel.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-43836
author: Valtersit Threat Intelligence
date: 2024/01/15
logsource:
    category: webserver
    product: apache
    definition: 'Access logs from Sulu CMS web server.'
detection:
    selection_admin_panel:
        cs-method: 'GET'
        cs-uri-query:
            - '*admin*'
    selection_file_include_patterns:
        cs-uri-query|contains:
            - 'php://filter'
            - 'php://input'
            - 'expect://'
            - 'data://'
            - 'file://'
            - '../../'
            - '..%2f..%2f'
            - '%00'
    condition: selection_admin_panel and selection_file_include_patterns
    timeframe: 5m
fields:
    - clientip
    - cs-uri-query
    - cs-method
    - cs-host
falsepositives:
    - Legitimate administrative operations involving file paths in admin panel
level: high

YARA Rule

rule CVE_2021_43836_Sulu_PHP_File_Inclusion
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects suspicious PHP file inclusion patterns indicative of CVE-2021-43836 exploitation"
        cve = "CVE-2021-43836"
        date = "2024-01-15"
    strings:
        $s1 = "sulu_route.generator.expression_token_provider" ascii wide
        $s2 = "php://filter" ascii wide nocase
        $s3 = "php://input" ascii wide nocase
        $s4 = "expect://" ascii wide nocase
        $s5 = "data://" ascii wide nocase
        $s6 = "file://" ascii wide nocase
        $s7 = "../" ascii wide
        $s8 = "..%2f" ascii wide nocase
        $s9 = "expression" ascii wide nocase
    condition:
        uint16(0) == 0x3C3F and // "<?"
        (1 of ($s2, $s3, $s4, $s5, $s6)) and
        (1 of ($s7, $s8)) or
        ($s1 and $s9 and 1 of ($s7, $s8))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2021-43836 - Sulu CMS PHP File Inclusion Attempt"; flow:established,to_server; content:"admin"; http_uri; content:"expression"; http_uri; pcre:"/(php://filter|php://input|expect://|data://|file://|\.\.\/|\.\.%2f)/i"; classtype:attempted-admin; sid:20210001; rev:1; reference:cve,CVE-2021-43836; reference:url,nvd.nist.gov/vuln/detail/CVE-2021-43836;)

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [network where destination.port == 443 and process.name == "php-fpm" and
   network.protocol == "http" and
   http.request.uri contains "admin" and
   (http.request.body contains "php://filter" or
    http.request.body contains "../../" or
    http.request.body contains "expression")] 
  [file where event.action == "read" and file.path : "/etc/*" or 
   file.extension == "conf" and process.name == "php-fpm"]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri_lower=lower(uri_path)
| where uri_lower like "%admin%"
| search uri_query IN ("*php://filter*", "*php://input*", "*expect://*", "*data://*", "*file://*", "*../*", "*..%2f*", "*%00*")
| stats count by src_ip, uri_path, uri_query, status, useragent
| sort -count
| where count > 1

Wazuh OSSEC Rule

<group name="sulu_cms,">
  <rule id="100201" level="12">
    <if_sid>31103</if_sid>
    <regex>(\$\.\./|\.\.%2f|php://filter|php://input|expect://|data://|file://)</regex>
    <description>CVE-2021-43836 - Sulu CMS PHP File Inclusion Attempt Detected</description>
    <group>web_application_attack,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <info type="cve">CVE-2021-43836</info>
  </rule>
  <rule id="100202" level="15">
    <if_sid>100201</if_sid>
    <regex>sulu_route\.generator\.expression_token_provider</regex>
    <description>CVE-2021-43836 - Sulu CMS PHP File Inclusion Exploitation Confirmed (Admin Panel Access)</description>
    <group>web_application_attack,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <info type="cve">CVE-2021-43836</info>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence was found from any tracked sources, despite the vendor's advisory indicating patched versions. This discrepancy suggests either a delay in patch propagation to public repositories or incomplete tracking by intelligence sources. Organizations should verify their Sulu version against the patched releases immediately.

1) Immediate Mitigations:

• Apply the vendor-provided workaround: Overwrite the service sulu_route.generator.expression_token_provider and wrap the translator before passing it to the expression language. This confines the expression evaluation context, preventing file inclusion.
• Restrict network access to the Sulu admin panel. Limit exposure to trusted IP addresses, VPN connections, or a jump host. If the admin panel does not need to be internet-facing, remove it from public access entirely.
• Enable multi-factor authentication for all admin panel accounts to reduce the risk of credential compromise leading to this vulnerability being exploited.
• Monitor logs for unusual file inclusion patterns (as detailed in the detection rules above) and for any access to sulu_route.generator.expression_token_provider from unexpected sources.

2) Patch/Upgrade Steps:

• Upgrade Sulu CMS to version 1.6.44, 2.2.18, 2.3.8, or 2.4.0 (or later) depending on your deployment branch. These versions contain the official fix.
• After upgrading, perform regression testing of the route generation and localization features to ensure no breakage.
• Verify the integrity of the upgrade by checking the release notes and hashes on the official Sulu repository.

3) Long-Term Hardening:

• Adopt a least-privilege model for the web server user running PHP. Ensure the PHP process can only read/write the directories it strictly needs.
• Disable dangerous PHP wrappers in php.ini (e.g., allow_url_include = Off) to reduce the impact of file inclusion vulnerabilities.
• Implement web application firewall (WAF) rules that block common file inclusion payloads at the perimeter.
• Maintain a regular patch cadence and subscribe to Sulu's security advisories for timely notifications.
• Conduct periodic code audits and penetration tests focused on the admin panel and route generation logic.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2021-43836
2. Sulu Official Website — https://sulu.io
3. Sulu GitHub Repository (Patch/Releases) — https://github.com/sulu/sulu/releases
4. CVE.org Record — https://www.cve.org/CVERecord?id=CVE-2021-43836

No CISA KEV (Known Exploited Vulnerabilities) listing was identified for CVE-2021-43836 as of the analysis date. No confirmed exploit-in-the-wild campaigns have been publicly attributed to this CVE, and the PoC/exploit status is currently private with no public Nuclei templates or exploit code available. Security teams are advised to treat this vulnerability with a priority commensurate with its CVSS score and the higher percentile EPSS score, indicating a plausible near-term exploitation risk.