File Browser Pre-Auth Command Injection RCE Analysis (CVSS 9.3)

Vulnerability Overview Vulnerability Name: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE) Vulnerability Description: The Hook Authentication feature in File Browser allows administrators to delegate login verification to an external shell command. User-provided credentials (username and password) are directly inserted into the command string using for substitution, without any sanitization. An unauthenticated remote attacker can inject shell metacharacters into the username or password fields of the login screen, resulting in arbitrary OS command execution prior to authentication. This is a critical pre-authentication Remote Code Execution (RCE) vulnerability. Scope of Impact Affected Versions: <= 2.63.5 Fixed Version: 2.63.6 CVSS Score: 9.3 (Critical) Attack Vector: Network Attack Complexity: Low Attack Requirements: None Privilege Requirements: None User Interaction: None Confidentiality Impact: High Integrity Impact: High Availability Impact: High Remediation Remediation Measure: Pass credentials exclusively as environment variables rather than using shell string substitution. Since this feature is undocumented, removing it should not cause issues. Technical Details HookAuth.RunCommand constructs the authentication command and substitutes credential values using : performs plain text substitution. No escaping, quoting, or validation is applied before embedding the credential values into the command string. If the administrator configures the hook authentication command as: An attacker submitting the username on the login screen results in the expanded command becoming: The terminates the expression, causing the shell to execute . The comments out the remainder, preventing syntax errors. The attacker's command is executed with the privileges of the File Browser process, without requiring a valid account or password. Attack Scenario / Reproduction Steps 1. The administrator enables Hook Authentication and sets the command to: 2. An unauthenticated attacker sends a login request (e.g., via or the web UI): - Username: - Password: (any value) 3. The server executes: 4. The command runs on the server, confirming pre-authentication RCE. No account is required. The attacker does not need to know any valid credentials. A single request is sufficient. Impact An unauthenticated remote attacker can execute arbitrary OS commands on the server at the privilege level of the File Browser process. This represents the most severe vulnerability category within this codebase. No Authentication Required — Exposed to the entire internet if the service is public-facing. Single Request — No setup, enumeration, or prior knowledge needed. Complete Server Compromise — Data exfiltration, persistent backdoor installation, and lateral movement within the internal network. Any internet-facing File Browser instance with Hook Authentication enabled can be fully compromised by a single malformed login attempt. Proof of Concept (POC) Code Remediation Recommendations Pass credentials exclusively as environment variables rather than using shell string substitution. Since this feature is undocumented, removing it should not cause issues.

Goal Reached Thanks to every supporter — we hit 100%!

File Browser Pre-Auth Command Injection RCE Analysis (CVSS 9.3)

More from this source