UniSharp Laravel Filemanager Unauthenticated RCE (CVE-2024-21546)

This repository contains security assessment tooling, detection templates, and an automated exploit toolkit for identifying and exploiting Unauthenticated Remote Code Execution (RCE) in applications utilizing the UniSharp/laravel-filemanager package (Versions < 2.9.1).

📑 Table of Contents

• 1. Vulnerability Overview
• 2. Root Cause Analysis
• 3. Nuclei Detection Template (laravel-filemanager.yaml)
  • Why Default Templates Fail on Localized Sites
  • Recreated Template Specification
  • Running the Nuclei Scan
• 4. Automated Exploit Toolkit (cve_2024_21546_rce.py)
  • Exploit Capabilities
  • Usage & Parameters
  • Examples
• 5. Remediation Guidance

1. Vulnerability Overview

The vulnerability stems from two combined conditions:

1. Unauthenticated Route Access: The host application registers /laravel-filemanager routes without applying the 'auth' or 'web' middleware pipeline.
2. Trailing Dot Extension Validation Bypass: The upload validator fails to properly sanitize trailing dot characters (.), allowing attackers to bypass executable file blocklists and place PHP scripts into public storage.

2. Root Cause Analysis

A. The Trailing Dot Validator Flaw (LfmUploadValidator.php)

In versions prior to v2.9.1, LfmUploadValidator.php checked file extensions against a blocklist using:

public function extensionIsNotExcutable($unallowed_extensions)
{
    $extension = strtolower($this->file->getClientOriginalExtension());
    if (in_array($extension, $unallowed_extensions)) {
        throw new \Exception('File extension is not allowed.');
    }
    return $this;
}

When an attacker uploads a file named poc.php.:

• Symfony's getClientOriginalExtension() extracts characters following the final dot.
• Since the filename ends in a dot, getClientOriginalExtension() evaluates to "" (empty string).
• The check in_array("", ['php', 'html']) evaluates to false, bypassing the extension block.

B. Extensionless Resolution & Rename Chaining

On Windows and specific storage drivers, the file is persisted as an extensionless hash (<hash>). The exploit chains LFM's RenameController (GET /laravel-filemanager/rename?file=<hash>&new_name=runner.php) to rename the uploaded payload into an active .php file, granting immediate web execution under /storage/app/public/file-manager-files/items/runner.php.

3. Nuclei Detection Template (laravel-filemanager.yaml)

Why Default Templates Fail on Localized Sites

The upstream community template (http/exposed-panels/laravel-filemanager.yaml) (https://github.com/projectdiscovery/nuclei-templates/blob/main/http/exposed-panels/laravel-filemanager.yaml) relied on a hardcoded English string matcher:

matchers:
  - type: word
    words:
      - "Laravel FileManager" # Fails on localized deployments or non english versions

When applications are localized (e.g. Arabic, French, Chinese), the English string is not present in the HTML body, causing false negatives.

Recreated Template Specification

The modernized template detects the panel by matching immutable vendor asset paths and upload form actions:

id: laravel-filemanager

info:
  name: Laravel File Manager - Panel Detect
  author: digitalsurgn
  severity: critical
  description: Laravel File Manager panel was detected.
  reference:
    - https://github.com/UniSharp/laravel-filemanager
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
    cwe-id: CWE-200
  metadata:
    max-request: 1
  tags: panel,laravel,filemanager,fileupload,intrusive

http:
  - method: GET
    path:
      - "{{BaseURL}}/laravel-filemanager?type=Files"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "vendor/laravel-filemanager"
          - "laravel-filemanager/upload"
        condition: or

      - type: status
        status:
          - 200

Running the Nuclei Scan

nuclei -u https://target.com/ -t laravel-filemanager.yaml

4. Automated Exploit Toolkit (cve_2024_21546_rce.py)

The standalone Python tool (cve_2024_21546_rce.py) automates end-to-end unauthenticated exploitation with built-in WAF evasion and self-cleaning hygiene.

Exploit Capabilities

• Protocol & Port Auto-Negotiation: Automatically discovers whether target uses HTTP or HTTPS and supports non-standard custom ports.
• Pre-Flight Access Verification: Confirms /laravel-filemanager is accessible without authentication before attempting exploitation.
• Dynamic File Tracking: Takes before/after snapshots of directory listings (jsonitems) to identify the uploaded hash without relying on hardcoded folder or file names.
• WAF Evasion: Uses PHP short tags (<?=), dynamic function invocation (('pas'.'sthru')), and Base64-encoded X-Cmd headers to evade inspection rules.
• Interactive Shell Mode: Supports continuous interactive shell sessions (--interactive).
• Zero-Footprint Auto-Cleanup: Automatically deletes the dropped webshell after each command execution.

Usage & Parameters

python3 cve_2024_21546_rce.py [OPTIONS]

Examples

1. Interactive Mode (Prompts for target, port, and command)

python3 cve_2024_21546_rce.py

2. Single Command Execution (CLI)

python3 cve_2024_21546_rce.py -t xyz.com -c "whoami"

3. Custom Non-Standard Port with Interactive Shell

python3 cve_2024_21546_rce.py -t 10.10.10.50 -p 8080 --interactive

5. Remediation Guidance

1. Upgrade Package: Update unisharp/laravel-filemanager to version 2.9.1 or later via Composer:
   root@kitploit:~

   composer update unisharp/laravel-filemanager
   

2. Enforce Authentication Middleware: Ensure all filemanager routes are protected by authentication in config/lfm.php:
   root@kitploit:~

   'middlewares' => ['web', 'auth'],
   

3. Restrict Public Storage: Configure web server rules to deny execution of .php scripts in public upload directories (e.g. /storage/).