Vulnerability: Directory Traversal in elFinder.AspNet This affects the package elFinder.AspNet before 1.1.1.
 The user-controlled file name is not properly sanitized before it is used to create a file system path.
Vulnerability ID: GHSA-pjxv-w3qj-j8m3
CWE: CWE-22
Severity score: 7.5
Project: https://github.com/mguinness/elFinder.AspNet
Published: 2021-08-09
File: elFinder.AspNet/Drivers/FileSystem/FileSystemDriver.cs
Commit message: Directory traversal fixes
Commit author: mguinness

Vulnerable version (before fix):
 public async Task<ConnectorResult> ExtractAsync(FullPath fullPath, bool newFolde                         string file = Path.Combine(rootPath, entry.FullName)                              .Replace("/", separator).Replace("\\", separator);                          if (file.EndsWith(separator)) //directory                         {                             var dir = new FileSystemDirectory(file); public async Task<ConnectorResult> RenameAsync(FullPath path, string name)             if (path.IsDirectory)             {                 var newPath = new FileSystemDirectory(Path.Combine(path.Directory.Parent.FullName, name));                 Directory.Move(path.Directory.FullName, newPath.FullName);                 response.Added.Add(await BaseModel.CreateAsync(newPath, path.RootVolume));             }             else             {                 var newPath = new FileSystemFile(Path.Combine(path.File.DirectoryName, name));                 File.Move(path.File.FullName, newPath.FullName);                 response.Added.Add(await BaseModel.CreateAsync(newPath, path.RootVolume));             }

Fixed version (after fix):
 public async Task<ConnectorResult> ExtractAsync(FullPath fullPath, bool newFolde                         string file = Path.Combine(rootPath, entry.FullName)                              .Replace("/", separator).Replace("\\", separator);                          string destPath = Path.GetFullPath(file);                         if (!destPath.StartsWith(rootPath, StringComparison.OrdinalIgnoreCase))                         {                             throw new NotSupportedException($"Entry '{entry.FullName}' is outside of the destination directory.");                         }                          if (file.EndsWith(separator)) //directory                         {                             var dir = new FileSystemDirectory(file); public async Task<ConnectorResult> RenameAsync(FullPath path, string name)             if (path.IsDirectory)             {                 var newPath = new FileSystemDirectory(Path.Combine(path.Directory.Parent.FullName, name));                 string destPath = Path.GetFullPath(newPath.FullName);                 if (!destPath.StartsWith(path.RootVolume.RootDirectory, StringComparison.OrdinalIgnoreCase))                 {                     throw new NotSupportedException($"Entry '{name}' is outside of the home directory.");                 }                 Directory.Move(path.Directory.FullName, newPath.FullName);                 response.Added.Add(await BaseModel.CreateAsync(newPath, path.RootVolume));             }             else             {                 var newPath = new FileSystemFile(Path.Combine(path.File.DirectoryName, name));                 string destPath = Path.GetFullPath(newPath.FullName);                 if (!destPath.StartsWith(path.RootVolume.RootDirectory, StringComparison.OrdinalIgnoreCase))                 {                     throw new NotSupportedException($"Entry '{name}' is outside of the home directory.");                 }                 File.Move(path.File.FullName, newPath.FullName);                 response.Added.Add(await BaseModel.CreateAsync(newPath, path.RootVolume));             }

Patch:
patch: @@ -229,6 +229,12 @@ public async Task<ConnectorResult> ExtractAsync(FullPath fullPath, bool newFolde
                         string file = Path.Combine(rootPath, entry.FullName)
                              .Replace("/", separator).Replace("\\", separator);
 
+                        string destPath = Path.GetFullPath(file);
+                        if (!destPath.StartsWith(rootPath, StringComparison.OrdinalIgnoreCase))
+                        {
+                            throw new NotSupportedException($"Entry '{entry.FullName}' is outside of the destination directory.");
+                        }
+
                         if (file.EndsWith(separator)) //directory
                         {
                             var dir = new FileSystemDirectory(file);
@@ -636,12 +642,22 @@ public async Task<ConnectorResult> RenameAsync(FullPath path, string name)
             if (path.IsDirectory)
             {
                 var newPath = new FileSystemDirectory(Path.Combine(path.Directory.Parent.FullName, name));
+                string destPath = Path.GetFullPath(newPath.FullName);
+                if (!destPath.StartsWith(path.RootVolume.RootDirectory, StringComparison.OrdinalIgnoreCase))
+                {
+                    throw new NotSupportedException($"Entry '{name}' is outside of the home directory.");
+                }
                 Directory.Move(path.Directory.FullName, newPath.FullName);
                 response.Added.Add(await BaseModel.CreateAsync(newPath, path.RootVolume));
             }
             else
             {
                 var newPath = new FileSystemFile(Path.Combine(path.File.DirectoryName, name));
+                string destPath = Path.GetFullPath(newPath.FullName);
+                if (!destPath.StartsWith(path.RootVolume.RootDirectory, StringComparison.OrdinalIgnoreCase))
+                {
+                    throw new NotSupportedException($"Entry '{name}' is outside of the home directory.");
+                }
                 File.Move(path.File.FullName, newPath.FullName);
                 response.Added.Add(await BaseModel.CreateAsync(newPath, path.RootVolume));
             }
path: elFinder.AspNet/Drivers/FileSystem/FileSystemDriver.cs