[Security] Bump studio-42/elfinder from 2.1.57 to 2.1.59 #780

dependabot-preview · 2021-06-16T10:56:16Z

Bumps studio-42/elfinder from 2.1.57 to 2.1.59. This update includes a security fix.

Vulnerabilities fixed

Sourced from The GitHub Security Advisory Database.

Unsafe upload filtering leading to remote code execution

Impact

Before elFinder 2.1.58, the upload filter did not disallow the upload of .phar files. As several Linux distributions are now shipping Apache configured in a way it will process these files as PHP scripts, attackers could gain arbitrary code execution on the server hosting the PHP connector (even in minimal configuration).

Patches

The issue has been addressed with Studio-42/elFinder@75ea92d, associating .phar files to the right MIME type. Unless explicitly allowed in the configuration, such files cannot be uploaded anymore. This patch is part of the last release of elFinder, 2.1.58.

Workarounds

If you can't update to 2.1.58, make sure your connector is not exposed without authentication.

Important tips

Server-side scripts can often be created as text files. Currently, elFinder has an appropriate MIME type set for file extensions that are generally runnable on a web server.

However, the server has various settings. In some cases, the executable file may be judged as "text/plain". Therefore, elFinder installers should understand the extensions that can be executed on the web server where elFinder is installed, and check if there are any missing items in the elFinder settings.

The elFinder PHP connector has an option "additionalMimeMap" that specifies the MIME type for each extension. See #3295(comment) for more information.

... (truncated)

Affected versions: < 2.1.58

Release notes

Sourced from studio-42/elfinder's releases.

Version 2.1.59

Changes form previous version

All previous changes is here.

[Security:php] Fixed multiple vulnerabilities leading to RCE

[php:session] Fixed #3278 wrong code of typo

[js:core] #3351 allow columnsCustomName[x] to be a function

[css:quicklook] Fixed #3240 remove unnecessary color specifications

[cmd:extract] Fixed #3252 for checking the existence of existing files

[js:core] Fixed #3359 add an option "noResizeBySelf"

[VD:abstract] Fixed #3216 missing url option on upload into root

And some minor bug fixes

Version 2.1.58

Changes form previous version

All previous changes is here.

[VD:abstract] Fixed #3151 support RAR5 lib

[cmd:fullscreen] Fixed #3177 wrong fullscreen button caption

[js:core] Supports cookie samesite attribute

[VD:SFTP] Add new SFTP driver, via phpseclib library

[js:core] Fixed #3193 auto-detection of baseUrl

[js:upload] Fixed upload bug (#3264)

[VD:abstract,php] make the thumbnail support webp (#3265)

[php:core] Fixed #3250 error only variables can be passed by reference

[VD:abstract] add 'phar:*' => 'text/x-php' into 'staticMineMap'

[VD:abstract] Fixed #3181 add an option uploadMaxMkdirs

[php:core] Add cwd param to proc_open (#3281)

[VD:abstract] Bugfix of an option mimeDetect (#3291)

[UI] Fixed #3302 problem of d&d when copy of UI command is disabled

And some minor bug fixes

Changelog

Sourced from studio-42/elfinder's changelog.

2021-06-13 Naoki Sawada hypweb+elfinder@gmail.com

elFinder (2.1.59):

[Security:php] Fixed multiple vulnerabilities leading to RCE

[php:session] Fixed #3278 wrong code of typo

[js:core] #3351 allow columnsCustomName[x] to be a function

[css:quicklook] Fixed #3240 remove unnecessary color specifications

[cmd:extract] Fixed #3252 for checking the existence of existing files

[js:core] Fixed #3359 add an option "noResizeBySelf"

[VD:abstract] Fixed #3216 missing url option on upload into root

And some minor bug fixes

2021-06-09 Naoki Sawada hypweb+elfinder@gmail.com

elFinder (2.1.58):

[VD:abstract] Fixed #3151 support RAR5 lib

[cmd:fullscreen] Fixed #3177 wrong fullscreen button caption

[js:core] Supports cookie samesite attribute

[VD:SFTP] Add new SFTP driver, via phpseclib library

[js:core] Fixed #3193 auto-detection of baseUrl

[js:upload] Fixed upload bug (#3264)

[VD:abstract,php] make the thumbnail support webp (#3265)

[php:core] Fixed #3250 error only variables can be passed by reference

[VD:abstract] add 'phar:*' => 'text/x-php' into 'staticMineMap'

[VD:abstract] Fixed #3181 add an option uploadMaxMkdirs

[php:core] Add cwd param to proc_open (#3281)

[VD:abstract] Bugfix of an option mimeDetect (#3291)

[UI] Fixed #3302 problem of d&d when copy of UI command is disabled

And some minor bug fixes

2020-06-05 Naoki Sawada hypweb+elfinder@gmail.com

elFinder (2.1.57):

[js] Fixed #3148 to support jQuery 3.5.0 update

[php:core] Fixed #3154 volume that require online access cannot be specified

[VD:abstract] Fixed #3161 fix option data of cwd results on after change files

[VD:abstract] Fixed #3167 added "none" (no image library check) to imgLib

[cmd:resize] Fixed #3158 to make able to change quality without changing dimensions

And some minor bug fixes

2020-04-09 Naoki Sawada hypweb+elfinder@gmail.com

elFinder (2.1.56):

[js:extras:editors.default] remove Pixlr editor it is no longer possible to display in IFRAME

[php:core] Fixed #3134 close file pointer before deleting temporary file on shutdown

[VD:abstract] change prefix of zipdl temp file

[php:core] Fixed #3136 zipdl fails on Chrome on iOS / iPadOS

[cmd:netmount] Fixed #3138 OAuth not possible with CORS due to new ITP

[VD:MySQL,OneDrive] Fixed #3142 remove debug code

[i18n:pl,ko] Updated translations

... (truncated)

Commits

06ada31 release elFinder version 2.1.59
33b7025 src build elFinder-2.1-c921a71
568d3e7 src build elFinder-2.1-28ea040
083cb08 release elFinder version 2.1.59
f4f7cd2 src build elFinder-2.1-cb8c1e8
07ab6a6 merge master README.md
34caa9e src build elFinder-2.1-6218e9b
395b806 src build elFinder-2.1-90be103
04fa60c src build elFinder-2.1-185ac78
3802892 release elFinder version 2.1.58
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Note: This repo was added to Dependabot recently, so you'll receive a maximum of 5 PRs for your first few update runs. Once an update run creates fewer than 5 PRs we'll remove that limit.

You can always request more updates by clicking Bump now in your Dependabot dashboard.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labels will set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
@dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

Update frequency (including time of day and day of week)
Pull request limits (per update run and/or open at any time)
Out-of-range updates (receive only lockfile updates, if desired)
Security updates (receive only security updates, if desired)

Bumps [studio-42/elfinder](https://github.com/Studio-42/elFinder) from 2.1.57 to 2.1.59. **This update includes a security fix.** - [Release notes](https://github.com/Studio-42/elFinder/releases) - [Changelog](https://github.com/Studio-42/elFinder/blob/master/Changelog) - [Commits](Studio-42/elFinder@2.1.57...2.1.59) Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

dependabot-preview bot added dependencies Pull requests that update a dependency file php Pull requests that update Php code security Pull requests that address a security vulnerability labels Jun 16, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Security] Bump studio-42/elfinder from 2.1.57 to 2.1.59 #780

[Security] Bump studio-42/elfinder from 2.1.57 to 2.1.59 #780

Uh oh!

dependabot-preview bot commented Jun 16, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

[Security] Bump studio-42/elfinder from 2.1.57 to 2.1.59 #780

Are you sure you want to change the base?

[Security] Bump studio-42/elfinder from 2.1.57 to 2.1.59 #780

Uh oh!

Conversation

dependabot-preview bot commented Jun 16, 2021

Impact

Patches

Workarounds

Important tips

Version 2.1.59

Changes form previous version

Version 2.1.58

Changes form previous version

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant