elfinder netmount CSRF漏洞分析(GHSA-8ngw35w6v2)

漏洞总结：CSRF in netmount allows forced FTP mounts and server-side FTP connections 漏洞概述 漏洞名称：CSRF in netmount allows forced FTP mounts and server-side FTP connections 漏洞编号：GHSA-8ngw35w6v2 严重程度：Moderate（CVSS v3.1 基础分数 5.4/10） 漏洞类型：CSRF（跨站请求伪造） 受影响组件： （Composer 包） 受影响版本：2.1.69 已修复版本：无（None） CWE：CWE-352（CSRF） 漏洞描述：PHP connector 的 CSRF gate 允许许多变更命令，但未保护 connector 命令。在最小化的 connector 配置中，FTP 网络挂载由 CSRF 绕过触发，攻击者可通过 eFinder 实例向远程 FTP 服务器发起出站连接。 影响范围 受影响版本：2.1.69 影响：攻击者可绕过 CSRF 保护，强制挂载 FTP 卷，并触发服务器端 FTP 连接。 攻击向量：网络（Network） 攻击复杂度：低 所需权限：无 用户交互：需要（Required） 影响范围：未变更（Unchanged） 机密性影响：低 完整性影响：低 可用性影响：无 修复方案 建议修复： - 在 中，在执行命令前，要求 CSRF 验证（包括 ）。 - 最小修复：在 中添加 的 CSRF 验证。 - 额外防御：在 中验证网络地址，限制允许的协议和端口。 - 回归测试： - 对 的 POST 请求，若缺少 头，应返回 HTTP 403，且 。 - 相同请求若带有有效的 头，应返回 HTTP 200，且 fake FTP 服务器日志记录服务器端 FTP 连接。 POC 代码 1. 创建可丢弃的测试环境 ```php mkdir -p tmp/elfinder-csrf-poc-claude/connector/tmp tmp/elfinder-csrf-poc-claude/logs cat > tmp/elfinder-csrf-poc-claude/connector.php array( 'driver' => 'LocalFilesystem', 'path' => __DIR__ . '/files', 'URL' => '/files', 'uploadMax' => '10M', 'uploadDeny' => array('text/plain'), 'uploadOrder' => array('deny', 'allow'), 'accessControl' => 'access' ), 'ftp' => array( 'driver' => 'FTP', 'host' => '127.0.0.1', 'port' => 2121, 'user' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'ftp', 'pass' => 'f

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

elfinder netmount CSRF漏洞分析(GHSA-8ngw35w6v2)

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

elfinder netmount CSRF漏洞分析(GHSA-8ngw35w6v2)

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！