| 标题 | KodCloud KodExplorer (KODExplorer) v4.31 - v4.54 Remote Code Execution (CWE-434 Arbitrary File Upload / Write) |
|---|
| 描述 | KodExplorer (KODExplorer) by KodCloud, a widely deployed open-source web file manager, contains an arbitrary file write vulnerability in the online editor save endpoint editor/fileSave (app/controller/editor.class.php:103-132) that leads to remote code execution. The endpoint performs no validation of the save path or the file extension: the 'path' parameter is normalized via _DIR() and concatenated directly into a filesystem path (with create_file=1, touch() creates the file), and the 'filestr' content, optionally base64-encoded, is written byte-for-byte via fopen(...,'wb') + fwrite(). The endpoint is enabled for the default role (editor.fileSave:1). Because KodExplorer's document root equals the application root, user directories and other writable paths reside under the docroot, and default deployments ship without an .htaccess/.user.ini that blocks PHP execution, any authenticated user with the default role can write a .php file into the docroot and have it executed by requesting it over HTTP — a single default-role account is therefore equivalent to remote code execution. The editor controller has received no security fix since v4.31 (confirmed via git log), and the latest release v4.54 remains vulnerable.
Reproduction: Environment KODExplorer v4.54 with PHP 7.3.4, docroot WWW/kod. 1. Log in with a default-role account (editor.fileSave:1). 2. Write a marker PHP file into the docroot: GET /index.php?editor/fileSave&path=marker2.php&create_file=1&base64=1&filestr=PD9waHAgZWNobyAiS09ELU9PS0siOw%3D%3D, response {"code":true,"data":"Saved successfully!"}; file created at WWW/kod/marker2.php. A path with a virtual prefix is equally writable (e.g. path=KOD_USER_SELF/marker_perm.php), proving the write point is not constrained to the user directory. 3. Execute it over HTTP: GET /marker2.php, response body "KOD-OOKK" (PHP executed). 4. Disk check: WWW/kod/marker2.php contains <?php echo 'KOD-OOKK';. Only harmless marker files were used; artifacts cleaned up. |
|---|
| 用户 | xiaochengqingjun (UID 100578) |
|---|
| 提交 | 2026-09-24 09時31分 (1 月前) |
|---|
| 管理 | 2026-10-24 23時35分 (1 month later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 426141 [KodCloud KodExplorer 直到 4.55 Online Editor Save Endpoint editor.class.php path/filestr 权限提升] |
|---|
| 积分 | 17 |
|---|