File Browser createUserDir Scope Isolation Bypass via Proxy/Hook Auth (RCE/Privacy Bypass)

Vulnerability Overview Title: Proxy and hook auto-provisioning ignores and grants the server root scope Description: File Browser's proxy and hook authentication auto-configuration paths do not respect the isolation intent of when the configuration defaults to the CLI default scope. When , the standard registration handler clears the inherited scope before calling , generating a user-specific directory such as . The proxy and hook authentication paths skip this step: they pass the inherited default scope ( ) directly to instead of generating a user-specific directory. As a result, each auto-configured proxy or hook user receives the File Browser server root as its scope. With default non-administrator privileges, a valid low-privileged upstream identity can read, create, overwrite, rename, share, and delete files belonging to other users. This is not a reverse proxy header spoofing issue. It remains exploitable even when the reverse proxy correctly authenticates the user, overriding any client-provided identity headers and stripping forwarded credentials. Observed in versions prior to v2.63.18: the proxy path was bypassed at runtime in earlier versions, and in versions v2.32.8 – v2.63.18 (where proxy user auto-provisioning was missing). Scope Affected Versions: <= 2.63.19 Fixed Version: 2.63.20 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: High Remediation Fixed Version: v2.63.20 Patch: In v2.63.19, auto-provisioned user creation was centralized in , covering registration, proxy authentication, and hook authentication; thus, these three paths can no longer diverge. When is enabled and no explicit scope is provided, the scope is cleared, and the scope is derived from each user's home directory ( ); the derived scope has been restricted (case-insensitive comparison) to prevent access by other users. For hook authentication, an explicit returned by a trusted hook is preserved. Workaround Before upgrading, do not rely on for isolation under proxy or hook authentication; assign an explicit, non-overlapping scope to each auto-provisioned user. Existing deployments should audit external configuration users with and redirect them to per-user directories. POC Code Proxy Authentication, behind a real reverse proxy Proxy/Hook Authentication, on loopback

Goal Reached Thanks to every supporter — we hit 100%!

File Browser createUserDir Scope Isolation Bypass via Proxy/Hook Auth (RCE/Privacy Bypass)

More from this source