efw4.X vulnerabilities

In versions prior to 4.08.010 of the efw4.X framework, the readonly flag set on the <efw:elFinder> JSP tag was intended to prevent file modifications. However, the lack of proper event handlers allows attackers to perform write operations by bypassing the user interface.

In versions prior to 4.08.010, the elfinder_checkRisk function in efw4.X does not validate the dst parameter used by elfinder_paste, allowing an attacker to copy or move files from the home directory to any arbitrary location by setting dst to a base64-encoded traversal path.

In efw4.X prior to version 4.08.010, the efw.file.FileManager.unZip method did not check the canonical path when writing zip entries to disk, allowing for directory traversal. An attacker could exploit this vulnerability to drop a malicious JSP file and execute arbitrary commands as the Tomcat user.