# 💣 Authenticated RCE in `laravel-file-manager` ≤ 3.3.1

## 📌 Summary

`laravel-file-manager` versions ≤ **3.3.1** are vulnerable to **Authenticated Remote Code Execution (RCE)**.  
An attacker with access to the file manager interface can upload a file with a non-PHP extension containing malicious PHP code, then use the **Rename Function** to change the extension to `.php`. When accessed publicly, the server executes the PHP code.

Additionally, the **Create File** and **Edit** functionality allows attackers to directly create `.php` files, inject PHP payloads, and achieve RCE.

**CVE ID:** _Pending Assignment_  
**Affected Version(s):** `<= 3.3.1`  
**Fixed Version:** _Pending Confirmation_  
**Impact:** Remote Code Execution (RCE)  
**Attack Vector:** Authenticated User  
**Severity:** **Critical** (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H : 9.9) 

---

## 🎯 Proof of Concept (PoC)

Below is a step-by-step exploitation walkthrough using the vulnerable interface.

### 🛠️ Prerequisites

- A valid user with access to `laravel-file-manager`
- Web browser and/or HTTP proxy (e.g., Burp Suite)
- PHP payload (example: `<?php system($_GET['cmd']); ?>`)

---

### 1️⃣ Install and Configure Laravel File Manager v3.1.1
![Step 1](images/step1.png)  
Proof of Concept `laravel-file-manager` v3.1.1 is installed and running.

---

### 2️⃣ Configure Allowed File Types in `file-manager.php`
![Step 2](images/step2.png)  
The `/config/file-manager.php` file is modified to set:

```php
'allowFileTypes' => ['png', 'jpeg', 'jpg', 'gif', 'pdf']
```

This restricts uploads to non-executable file types. Establishing the baseline security settings.

---

### 3️⃣ Access the File Upload Interface
![Step 3](images/step3.png)  
The **upload interface** is accessed, which let the user **Upload** files.

---

### 4️⃣ Attempt to Upload a PHP File
![Step 4](images/step4.png)  
An attempt to upload `php.php` fails with:

> *"Some files weren't uploaded!"*

The configuration blocks direct `.php` uploads but allows only image and document formats.

---

### 5️⃣ Upload a Crafted PNG File
![Step 5](images/step5.png)  
A malicious file `php.png` containing PHP code is uploaded successfully since `.png` is allowed.

---

### 6️⃣ Use the Rename Function
![Step 6](images/step6.png)  
The **Rename** function is selected for `php.png`.

---

### 7️⃣ Rename PNG to PHP Extension
![Step 7](images/step7.png)  
The file is renamed to `php.php`, bypassing the upload restriction.

---

### 8️⃣ View File Properties and Public URL
![Step 8](images/step8.png)  
The **Properties** panel reveals a publicly accessible URL:

```
http://server-ip-address/storage/php.php
```

---

### 9️⃣ Execute the Webshell
![Step 9](images/step9.png)  
Accessing the URL executes the PHP payload and displays a malicious php (webshell).

---

### 🔁 Alternative Path: PDF Upload

### 1️⃣ Upload a Crafted PDF File
![Step 10](images/step10.png)  
A malicious `shell.pdf` file with embedded PHP code is uploaded successfully.

---

### 2️⃣ Rename PDF to PHP Extension
![Step 11](images/step11.png)  
`shell.pdf` is renamed to `shell.php`.

---

### 3️⃣ View PDF-to-PHP File Properties
![Step 12](images/step12.png)  
The **Properties** panel shows the public URL:

```
http://server-ip-address/storage/malicious.php
```

---

### 4️⃣ Execute the PDF Webshell
![Step 13](images/step13.png)  
Opening `shell.php` triggers code execution, yielding a functional webshell.

---

### 🖊️ Alternative Path: Direct File Creation

### 1️⃣ Create a PHP File Directly
![Step 14](images/step14.png)  
The **Create File** function is used to create `My name is PHP.php` directly.

---

### 2️⃣ Edit the Created PHP File
![Step 15](images/step15.png)  
The **Edit** function is selected for `My name is PHP.php`.

---

### 3️⃣ Insert Malicious Webshell Code
![Step 16](images/step16.png)  
A malicious PHP payload is inserted and saved.

---

### 4️⃣ Execute the Created File Webshell
![Step 17](images/step17.png)  
Accessing:

```
http://server-ip-address/storage/My%20name%20is%20PHP.php
```

executes the webshell, confirming RCE.

---

## 💥 Impact

Successful exploitation allows **remote code execution** with the web server's privileges.  
An attacker could:

- Exfiltrate sensitive data  
- Deploy persistent backdoors  
- Move laterally within the internal network  
- Fully compromise the host
