Attack Chain

1. An attacker sends a crafted HTTP request to an elFinder instance, targeting the resize command.
2. The request includes a malicious bg parameter value containing shell metacharacters.
3. elFinder processes the request and passes the bg parameter to the volume resize handling function.
4. The application determines that image processing should use the ImageMagick CLI backend.
5. The application interpolates the unsanitized bg parameter value into a shell command string.
6. The injected shell metacharacters are interpreted by the shell, allowing the attacker to inject arbitrary commands.
7. The system executes the crafted shell command with the privileges of the web server process.
8. The attacker achieves arbitrary code execution on the server, potentially leading to data exfiltration or system compromise.

Impact

Successful exploitation allows an attacker to execute arbitrary operating system commands with the privileges of the web server process. The impact depends on the server configuration, enabled commands, the backend image library selection, and any existing deployment controls. A successful attack could lead to complete system compromise, data breaches, or denial of service. While the specific number of affected installations is unknown, this vulnerability presents a high risk due to the potential for significant damage.

Recommendation

• Upgrade elFinder to version 2.1.67 or later to patch the vulnerability.
• If upgrading is not immediately feasible, disable the resize command within elFinder's configuration to prevent exploitation.
• If resize command is needed, avoid using the ImageMagick CLI backend for image processing and use a safer library.
• Deploy the Sigma rule "elFinder Resize Command Injection Attempt" to detect exploitation attempts based on suspicious characters in the cs-uri-query (webserver log source).
• Monitor web server logs for unusual command invocations originating from the web server process, which could indicate successful exploitation.