Improper access control in FileBrowser - #VU139765

Detailed vulnerability description

The vulnerability allows a remote user to disclose sensitive information and modify or delete protected files.

The vulnerability exists due to improper access control in recursive copy, rename, and delete operations in http/resource.go when processing resource API requests on allowed parent paths with denied descendants. A remote user can copy, rename, or delete an allowed parent directory to disclose sensitive information and modify or delete protected files.

Exploitation requires a rule configuration that denies one or more descendant paths while leaving the parent path allowed, and the user must have the relevant file-operation permission on the parent directory.

Remediation

Sources

• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-77x8-73f4-5485
• https://github.com/filebrowser/filebrowser/commit/72faf6dd3c85628e332d3e567124b86708ce2695