Server Side Request Forgery (SSRF)

Affecting studio-42/elfinder package, versions <2.1.46

Overview

studio-42/elfinder is a open-source file manager for web, written in JavaScript using jQuery UI.

Affected versions of this package are vulnerable to Server Side Request Forgery (SSRF). Malicious users could gain access to the contents of internal network resources. This occurs in get_remote_contents() in php/elFinder.class.php.

Remediation

Upgrade studio-42/elfinder to version 2.1.46 or higher.

References

Do your applications use this vulnerable package?

CVSS Score

7.2
high severity
  • Attack Vector
    Network
  • Attack Complexity
    Low
  • Privileges Required
    High
  • User Interaction
    None
  • Scope
    Unchanged
  • Confidentiality
    High
  • Integrity
    High
  • Availability
    High
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Credit
Do Ha Anh
CVE
CVE-2019-6257
CWE
CWE-918
Snyk ID
SNYK-PHP-STUDIO42ELFINDER-73510
Disclosed
14 Jan, 2019
Published
14 Jan, 2019