-
Notifications
You must be signed in to change notification settings - Fork 1.4k
Closed
Description
Describe the bug
There is no restriction for uploading the file with the .php8 extension. I encountered this situation during penetration testing of a website that uses the elFinder.
In some environments, .php8 can be executed as PHP. Especially, when the PHP is updated from a lower version to 8.x, the .php8 can be added to the .htaccess file for PHP handling like:
For PHP 8.0:
AddHandler application/x-httpd-ea-php80 .php .php8 .phtml
For PHP 8.1:
AddHandler application/x-httpd-ea-php81 .php .php8 .phtml
In another case, .php8 can be executed as PHP according to following the Apache configuration.
<FilesMatch ".+\.ph(p[7-8]?|tml)$">
SetHandler application/x-httpd-php
</FilesMatch>
To Reproduce
Steps to reproduce the behavior:
- Select arbitrary png file to upload.
- Capture request with Burp and set content as
test<?php phpinfo();?> - Set filename like
test.php8 - After forwarding the request, the file is successfully uploaded under the
filesdirectory
Expected behavior
I think that the php8 can be added to the staticMineMap array in the elFinderVolumeDriver class.
Metadata
Metadata
Assignees
Labels
No labels

