| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| github.com/filebrowser/filebrowser | mọi phiên bản | |
| github.com/filebrowser/filebrowser/v2 | < 2.57.1 | 2.57.1 |
| filebrowser | < 2.57.1 | 2.57.1 |
An authenticated user can bypass the application's "Disallow" file path rules by modifying the request URL. By adding multiple slashes (e.g., //private/) to the path, the authorization check fails to match the rule, while the underlying filesystem resolves the path correctly, granting unauthorized access to restricted files.
The vulnerability allows users to bypass "Disallow" rules defined by administrators.
The issue stems from how the application handles URL path normalization and rule matching:
http/http.go is configured with r.SkipClean(true). This prevents the automatic collapse of multiple slashes (e.g., // becoming /) before the request reaches the handler.rules/rules.go relies on a simple string prefix match: strings.HasPrefix(path, r.Path). If a rule disallows /private, a request for //private fails this check because //private does not strictly start with /private.The following steps demonstrate the vulnerability:
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phíThis vulnerability impacts the confidentiality and integrity of data stored in filebrowser.