Summary
An authenticated user can bypass the application's "Disallow" file path rules by modifying the request URL. By adding multiple slashes (e.g., //private/) to the path, the authorization check fails to match the rule, while the underlying filesystem resolves the path correctly, granting unauthorized access to restricted files.
Details
The vulnerability allows users to bypass "Disallow" rules defined by administrators.
The issue stems from how the application handles URL path normalization and rule matching:
- Router Configuration: The router in
http/http.go is configured with r.SkipClean(true). This prevents the automatic collapse of multiple slashes (e.g., // becoming /) before the request reaches the handler.
- Insecure Rule Matching: The rule enforcement logic in
rules/rules.go relies on a simple string prefix match: strings.HasPrefix(path, r.Path). If a rule disallows /private, a request for //private fails this check because //private does not strictly start with /private.
- Filesystem Resolution: After bypassing the rule check, the non-normalized path is passed to the filesystem. The filesystem treats the multiple slashes as a single separator, successfully resolving //private/secret.txt and serving the file.
PoC
Python minimal PoC
The following steps demonstrate the vulnerability:
- Setup:
- Admin user creates a folder /private and adds a file /private/secret.txt.
- Admin adds a Disallow rule for user bob on the path /private.
- Verification:
- User bob requests GET /api/resources/private/secret.txt.
- Server responds: 403 Forbidden.
3. Exploit:
- User bob requests GET /api/resources//private/secret.txt.
- Server responds: 200 OK (Bypass successful).
Impact
This vulnerability impacts the confidentiality and integrity of data stored in filebrowser.
- Confidentiality: Users can read files they are explicitly forbidden from accessing.
- Integrity: If the user has general write permissions but is restricted from specific directories via rules, they can bypass these restrictions to rename, delete, or modify files.
References
Summary
An authenticated user can bypass the application's "Disallow" file path rules by modifying the request URL. By adding multiple slashes (e.g., //private/) to the path, the authorization check fails to match the rule, while the underlying filesystem resolves the path correctly, granting unauthorized access to restricted files.
Details
The vulnerability allows users to bypass "Disallow" rules defined by administrators.
The issue stems from how the application handles URL path normalization and rule matching:
http/http.gois configured withr.SkipClean(true). This prevents the automatic collapse of multiple slashes (e.g., // becoming /) before the request reaches the handler.rules/rules.gorelies on a simple string prefix match:strings.HasPrefix(path, r.Path). If a rule disallows /private, a request for //private fails this check because //private does not strictly start with /private.PoC
Python minimal PoC
The following steps demonstrate the vulnerability:
- Admin adds a Disallow rule for user bob on the path /private.
3. Exploit: - User bob requests GET /api/resources//private/secret.txt. - Server responds: 200 OK (Bypass successful).Impact
This vulnerability impacts the confidentiality and integrity of data stored in filebrowser.
References