CVE-2021-46398

A Cross-Site Request Forgery vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim. An admin can run commands using the FileBrowser and hence it leads to RCE.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

6.66% chance of exploitation in the next 30 days, 93th percentile

Published

2022-02-04

Updated

2024-08-04

Proof-of-concept exploits (7)

• http://packetstormsecurity.com/files/165885/FileBrowser-2.17.2-Code-Execution-Cross-Site-…
• https://febin0x4e4a.blogspot.com/2022/01/critical-csrf-in-filebrowser.html
• https://febin0x4e4a.wordpress.com/2022/01/19/critical-csrf-in-filebrowser/
• https://febinj.medium.com/critical-csrf-to-rce-in-filebrowser-865a3c34b8e7
• https://systemweakness.com/critical-csrf-to-rce-in-filebrowser-865a3c34b8e7
• LalieA/CVE-2021-463980★ · 2023-09-10
• febinrev/CVE-2021-46398_Chamilo-LMS-RCE5★ · 2022-03-22

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/50717

References

• CVE Record
• NVD entry

Related

• CVE-2021-27928
• CVE-2019-6447
• CVE-2021-45010
• CVE-2022-0847
• CVE-2023-44451
• CVE-2023-44452