Executive brief
elFinder is a popular file manager library used to provide file upload and browsing capabilities in web applications. When cURL is unavailable, elFinder's URL upload feature falls back to socket-based connections that bypass IP address validation, allowing attackers to access internal services on loopback or private networks. An attacker can craft a specially prepared hostname that resolves to different IP addresses on successive DNS lookups—initially returning an allowed public IP to pass validation, then resolving to an internal address during the actual connection. Since responses are saved as uploaded files and readable through elFinder, this enables non-blind disclosure of sensitive internal data.
Technical details
The vulnerability is a TOCTOU (Time-of-Check-Time-of-Use) flaw in URL upload validation. The validate_address() function resolves a hostname once using gethostbyname(), rejects addresses in loopback or private ranges, and stores the result in $info['ip']. However, the socket fallback (fsock_get_contents()) ignores this validated IP and calls fsockopen() with the original hostname string, triggering a second DNS resolution. An attacker controlling DNS can return a whitelisted public IP on the first lookup (passing validation) and a loopback/private IP on the second (enabling the actual connection to internal services). The cURL code path correctly pins the validated IP using CURLOPT_RESOLVE, but only when the cURL extension is available. Additionally, redirect handling and a subsequent get_headers() call both repeat the hostname resolution without IP pinning. Exploitation requires PHP without cURL, access to URL upload functionality, and network connectivity from the PHP process to the target internal service. A working proof-of-concept demonstrates reading internal secrets by uploading from an attacker-controlled DNS server.
Affected products
- Studio-42 elFinder <= 2.1.69
Timeline
- 2026-07-24: disclosed: Initial private report date
- 2026-08-03: patched: Patched in version 2.1.70
- 2026-08-31: advisory: Published to GitHub Advisory Database