Can you explain this vulnerability to me?

This vulnerability in File Browser occurs because the application does not explicitly set file access permissions for files uploaded or created through it, nor for its database file. Instead, it relies on the system's default umask setting, which on many Linux systems is 022. This results in files being created with permissions that allow any user on the operating system to read them (e.g., permissions 0644). Consequently, sensitive files and the database containing password hashes can be read by any OS account or other applications on the same server, exposing confidential information. [2]

Useful 0 Not Useful 0

How can this vulnerability impact me? :

The vulnerability can impact you by exposing sensitive files and the File Browser database to any user or application on the same server, since files are created with overly permissive read permissions. This compromises confidentiality, allowing unauthorized users to read potentially sensitive data such as uploaded files and password hashes. However, it does not affect the integrity or availability of the files or the application. [2]

Useful 0 Not Useful 0

How can this vulnerability be detected on my network or system? Can you suggest some commands?

This vulnerability can be detected by checking the file permissions of files and the database used by File Browser. Specifically, you should look for files with permissions that allow read access to others (e.g., 0644 or -rw-r--r--). Commands such as `ls -l /path/to/filebrowser/datadir` or `find /path/to/filebrowser/datadir -type f -perm /o=r` can help identify files that are world-readable. Also, checking the permissions of the File Browser database file (e.g., filebrowser.db) with `ls -l` can reveal if it is improperly accessible. [2]

Useful 0 Not Useful 0

What immediate steps should I take to mitigate this vulnerability?

Immediate mitigation steps include manually correcting the file permissions of all files and directories managed by File Browser to restrict access to others. This can be done by running a command such as `chmod o-rwx -R /srv/filebrowser/datadir` to remove read, write, and execute permissions for others recursively. Additionally, upgrading File Browser to version 2.33.7 or later is recommended, as this version explicitly sets stricter file and directory permissions (files to 0640 and directories to 0750) and applies secure permissions to the database file. [2, 1]

Useful 0 Not Useful 0