elunez eladmin Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in elunez eladmin versions through 2.7. The issue arises in the checkFile function within the file /api/deploy/upload, where improper handling of the servers argument leads to deserialization. This vulnerability can be exploited remotely during the application deployment process.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the remote server where the application is deployed.

Reproduction

To reproduce this vulnerability, first upload a file through the application interface that is designed for deployment. During this process, the checkFile function is called to verify the existence of the deployment file. By manipulating the application name to include malicious payloads, the vulnerability can be exploited, leading to remote code execution on the target server.