Chaining PHP2Shell — A Deep Dive into CVE

Chaining PHP2Shell (CVE-2021-4034)

An arbitrary file upload vulnerability in ProjectSend r1295 and earlier allows remote attackers to execute arbitrary code. This critical flaw enables an attacker to upload malicious PHP files, including sophisticated web shells like PHP2Shell. Successful exploitation leads to full server compromise, data exfiltration, and potential lateral movement within the network. This vulnerability carries a CVSSv3 score of 9.8 (Critical).

What the vulnerability is and its impact

CVE-2021-4034 specifically affects ProjectSend, a self-hosted application for sharing files with clients. The vulnerability exists within the file upload mechanism. It fails to adequately validate the type and content of uploaded files. An attacker can bypass existing checks and upload executable PHP code directly to the web server.

The immediate impact of Chaining PHP2Shell (CVE-2021-4034) is remote code execution (RCE). An attacker can run arbitrary operating system commands on the compromised server. This grants them complete control over the web application and underlying system. They can steal sensitive data, deface the website, or use the server as a pivot point for further attacks.

Affected versions include ProjectSend r1295 and all prior releases. Organizations running these versions face severe risk. Unpatched instances are exposed to immediate compromise. The vulnerability does not require authentication in some configurations, making it even more dangerous.

Technical root cause analysis

The root cause of CVE-2021-4034 lies in insufficient server-side validation of uploaded file types. ProjectSend's upload functionality relies on client-side checks or easily bypassable server-side MIME type validations. Attackers manipulate HTTP requests to send files with dangerous extensions. The application then saves these files to a web-accessible directory.

Specifically, the application's file processing logic does not rigorously confirm the true file type. It might inspect only the file extension or the Content-Type header in the HTTP request. Both are trivial for an attacker to spoof. A malicious PHP file disguised as an image (e.g., shell.php.jpg or with a manipulated Content-Type) successfully bypasses these weak checks.

The default configuration often places uploaded files into directories directly served by the web server. This allows an attacker to simply navigate to the uploaded malicious file's URL. Once accessed, the web server executes the PHP code. This completes the RCE chain and allows for Chaining PHP2Shell (CVE-2021-4034) to proceed to full control.

Exploitation mechanics

Exploiting CVE-2021-4034 involves crafting a specific HTTP POST request. This request uploads a malicious PHP file to the target ProjectSend instance. The attacker must identify the upload endpoint, typically found by examining the application's source code or observing legitimate upload traffic.

An attacker prepares a simple PHP web shell. A common example is <?php system($_GET['cmd']); ?>. This basic shell executes any command passed via the 'cmd' GET parameter. More advanced attackers might deploy a full-featured web shell like PHP2Shell for better interaction and persistence.

The critical step is bypassing file type restrictions. If the application checks the file extension, an attacker might use a double extension (e.g., image.jpg.php) or a null byte injection (image.php%00.jpg) if the server-side processing truncates the filename. If only MIME types are checked, setting the Content-Type header to image/jpeg while the file content is PHP code often works.

Once the malicious file is uploaded, the attacker accesses it via a web browser. For example, if the file uploads to /uploads/files/shell.php, visiting http://target.com/uploads/files/shell.php?cmd=id executes the id command on the server. This establishes the initial foothold and allows for Chaining PHP2Shell (CVE-2021-4034) by uploading and executing more complex tools.

Detection: how to check if you're affected

Organizations must actively check for ProjectSend instances and their versions. Start by enumerating all web-facing assets. A free website vulnerability scanner can help identify ProjectSend installations and flag outdated versions. Regularly scan your attack surface for known vulnerabilities.

Inspect web server access logs for unusual activity. Look for POST requests to upload endpoints that contain suspicious file extensions (e.g., .php, .phtml) or unusual MIME types. Monitor for subsequent GET requests to newly created PHP files in upload directories. These are strong indicators of attempted or successful exploitation.

Perform file integrity monitoring on ProjectSend's installation and upload directories. Any unexpected PHP files appearing in non-standard locations, especially within publicly accessible upload folders, warrant immediate investigation. Tools like Tripwire or OSSEC can alert on such changes.

Use a technology stack detector to ensure all components, including PHP versions and web servers, are current. While not directly detecting CVE-2021-4034, outdated components often have other vulnerabilities that can be chained. Secably's tools offer continuous monitoring for such exposures.

Consider using external scanning services like Zondex for internet-wide scanning. This helps identify exposed ProjectSend instances from an attacker's perspective. It provides a view of your external attack surface, highlighting services that might be vulnerable.

Remediation steps

The primary remediation for CVE-2021-4034 is to update ProjectSend immediately. The vendor released a patch addressing this vulnerability. Apply the latest version, which incorporates robust file upload validation. Always consult the official ProjectSend advisory for specific update instructions.

Implement strict server-side file validation. Do not rely on client-side checks or MIME types alone. Instead, process uploaded files by:

• Whitelisting allowed file extensions (e.g., .jpg, .png, .pdf).
• Inspecting file headers (magic bytes) to confirm the true file type, independent of the extension or MIME type.
• Renaming uploaded files to prevent execution (e.g., appending a random string, using a non-executable extension).

Configure web servers to prevent script execution in upload directories. For Apache, use <FilesMatch "\.php$">Order allow,denyDeny from all</FilesMatch> directives or similar for Nginx. This ensures that even if a malicious PHP file is uploaded, the server will not execute it.

Enforce the principle of least privilege for the web server user. The user running the web server (e.g., www-data) should only have read and write access to necessary directories. It should not have execution privileges in upload folders or write access to application code directories.

Regularly scan your web applications for web shells. Automated tools can detect common web shell patterns, including PHP2Shell. Combine this with manual reviews of suspicious files found during integrity monitoring. Consult resources like PHP2Shell Explained — Why You Must Patch Now for more context on web shell threats.

Timeline of disclosure

The vulnerability, CVE-2021-4034, was publicly disclosed on October 18, 2021. Details were published by researchers, outlining the arbitrary file upload flaw in ProjectSend. The disclosure followed responsible reporting practices, allowing the vendor time to develop and release a patch.

ProjectSend addressed the vulnerability in subsequent releases. Users were advised to update to a patched version to mitigate the risk of Chaining PHP2Shell (CVE-2021-4034) and similar attacks. The rapid disclosure and patching highlighted the critical nature of file upload vulnerabilities in web applications.