elFinder CVE-2021-23394 Reproduction Setup

This repository contains a reproduction setup for CVE-2021-23394 (Arbitrary File Execution in elFinder) using Docker. It sets up four environments to compare vulnerable and patched versions across Apache and Nginx.

Overview

The setup includes:

1. Apache Vulnerable (Port 8080): elFinder 2.1.57 on Apache
2. Apache Patched (Port 8081): elFinder 2.1.66 on Apache
3. Nginx Vulnerable (Port 8082): elFinder 2.1.57 on Nginx
4. Nginx Patched (Port 8083): elFinder 2.1.66 on Nginx

Prerequisites

• Docker
• Nuclei (for testing)

Setup

1. Make the setup script executable (if it isn't already):

   root@kitploit:~

   chmod +x setup_containers.sh
   

2. Run the setup script:

   root@kitploit:~

   ./setup_containers.sh
   

   This will build the Docker images and start the containers.

Usage / Verification

You can access the elFinder interface in your browser at:

• http://localhost:8080/elfinder/elfinder.html
• http://localhost:8081/elfinder/elfinder.html
• http://localhost:8082/elfinder/elfinder.html
• http://localhost:8083/elfinder/elfinder.html

Testing with Nuclei

To verify the vulnerability (or the fix), use Nuclei with the appropriate template.

Run the following commands (replace path-to-nuclei-templates with the actual path to your templates directory):

# Test Apache Vulnerable (should be vulnerable)
nuclei -t path-to-nuclei-templates/http/cves/2021/CVE-2021-23394.yaml -u http://localhost:8080

# Test Apache Patched (should NOT be vulnerable)
nuclei -t path-to-nuclei-templates/http/cves/2021/CVE-2021-23394.yaml -u http://localhost:8081

# Test Nginx Vulnerable (should be vulnerable)
nuclei -t path-to-nuclei-templates/http/cves/2021/CVE-2021-23394.yaml -u http://localhost:8082

# Test Nginx Patched (should NOT be vulnerable)
nuclei -t path-to-nuclei-templates/http/cves/2021/CVE-2021-23394.yaml -u http://localhost:8083

Alternatively, test all at once by creating a targets.txt file:

echo -e "http://localhost:8080\nhttp://localhost:8081\nhttp://localhost:8082\nhttp://localhost:8083" > targets.txt
nuclei -t path-to-nuclei-templates/http/cves/2021/CVE-2021-23394.yaml -l targets.txt

Expected Results:

• Ports 8080 & 8082 (Vulnerable): Should be identified as vulnerable.
• Ports 8081 & 8083 (Patched): Should not be identified as vulnerable.

Cleanup

To stop and remove the containers, you can run the cleanup command inside the script or manually:

docker rm -f elfinder-apache-vuln elfinder-apache-patched elfinder-nginx-vuln elfinder-nginx-patched