Description

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validate_address() validates $info['ip'], but get_remote_contents() selects fsock_get_contents(), which connects to $arr['host'] and performs a second DNS resolution. An attacker able to submit a URL upload can use DNS rebinding to have the first resolution return a public address and the connection resolution return a loopback or private address, causing the internal HTTP response body to be stored as an uploaded file and made readable through elFinder. After a successful fetch, get_headers($url, true) separately requests the original hostname without reusing the validated and pinned connection, creating an additional blind server-side request forgery path even when curl_get_contents() is selected. This issue is fixed in version 2.1.70.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-31T21:17:52.460Z",
  "pubdate": "2026-08-31T21:17:52.460Z",
  "executiveSummary": "elFinder versions prior to 2.1.70 are vulnerable to a Server-Side Request Forgery (SSRF) flaw within the URL upload functionality in php/elFinder.class.php.\nThe vulnerability arises from inconsistent validation between the URL address verification phase and the actual connection phase, specifically when the environment lacks PHP cURL support.\nBy leveraging DNS rebinding, an attacker can bypass security checks that ensure the target IP is public, allowing the application to fetch content from internal or loopback network resources.\nA secondary SSRF vector exists due to improper use of get_headers($url, true), which initiates a redundant, unpinned request to the original hostname, enabling blind SSRF regardless of the primary fetch method.\nSuccessful exploitation allows an unauthorized attacker to retrieve sensitive internal HTTP response bodies, which are then saved as accessible files within the elFinder file manager.\nThe risk is high, as it enables attackers to probe private network infrastructure, bypass firewalls, and exfiltrate information accessible to the web server that would otherwise be protected from the public internet.",
  "technicalDetails": "The vulnerability resides in the interaction between validate_address() and the subsequent remote file retrieval mechanisms within php/elFinder.class.php. In configurations where the PHP cURL extension is unavailable, elFinder defaults to using fsock_get_contents() to perform remote URL uploads.\nThe primary root cause is a Time-of-Check to Time-of-Use (TOCTOU) discrepancy involving DNS resolution. The validate_address() function performs an initial resolution to verify that the destination IP address is not a prohibited private or loopback address. However, the subsequent fetch via fsock_get_contents() performs an independent DNS resolution when connecting to the host. An attacker can exploit this by configuring a malicious DNS server that returns a public IP during the validation phase and flips to an internal or loopback IP during the actual connection attempt.\nThe attack flow proceeds as follows: 1) The attacker submits a malicious URL pointing to a domain under their control. 2) validate_address() resolves the domain, receives a legitimate public IP address, and passes the validation check. 3) The application proceeds to get_remote_contents(), which utilizes fsock_get_contents() to initiate a connection. 4) The DNS server provides a restricted IP (e.g., 127.0.0.1) for the second resolution. 5) The application retrieves data from the internal resource, effectively bypassing network-level security controls. 6) The resulting HTTP response body is stored as a file within the elFinder directory, which the attacker can subsequently read via the file manager interface.\nAdditionally, a secondary vulnerability exists in the handling of HTTP headers. The application calls get_headers($url, true) to extract metadata from the remote URL. This process creates a distinct, unpinned request to the provided URL. Because this request does not reuse the connection validated by earlier logic, it creates a blind SSRF path. Even if the primary fetching method is secured via cURL, this redundant call allows an attacker to generate unauthorized requests from the server to arbitrary targets, facilitating internal network reconnaissance and potentially triggering actions on other internal web services that trust the origin of the server's IP address."
}