File Browser has an Authorization Policy Bypass in Public Share Download Flow

Summary

A permission enforcement flaw allows users without download privileges (download=false) to still expose and retrieve file content via public share links when they retain share privileges (share=true). This bypasses intended access control policy and enables unauthorized data exfiltration to unauthenticated users. Where download restrictions are used for data-loss prevention or role separation.

Details

The backend applies inconsistent authorization checks across download paths:

• Direct raw download correctly enforces Perm.Download:
  • [raw.go](filebrowser/http/raw.go:82)
• Share creation only enforces Perm.Share:
  • [share.go](filebrowser/http/share.go:21)
• Public share/download handlers serve shared content without verifying owner Perm.Download:
  • public.go(filebrowser/http/public.go:18)
  • public.go(filebrowser/http/public.go:116)

As a result, a user who is blocked from direct downloads can create a share and obtain the same file via /api/public/dl/<hash>.

PoC

1. Create a non-admin user with:

• perm.share = true
• perm.download = false

2. Login as that user and upload a PDF file:

• POST /api/resources/nodl_secret_<rand>.pdf with Content-Type: application/pdf

3. Verify direct raw download is denied:

• GET /api/raw/nodl_secret_<rand>.pdf
• Expected and observed: 202 Accepted (blocked)

4. Create share for same file:

• POST /api/share/nodl_secret_<rand>.pdf
• Observed: 200, response includes hash (example: )