Permission Bypass in File Browser Allows Unauthorized File Exfiltration

Executive Summary

This vulnerability is a permission enforcement bypass in File Browser versions 2.61.0 and below. It allows users who do not have download privileges (perm.download = false) but do have share privileges (perm.share = true) to access and exfiltrate file content by creating public share links.

While the direct raw download endpoint correctly enforces download permissions, the share creation endpoint only checks for share permission. The public download handler serves file content without verifying if the original file owner has download permission. This means an authenticated user with share access can bypass download restrictions by sharing a file and then retrieving it via the unauthenticated public download URL.

This flaw undermines data-loss prevention and role-separation policies because restricted users can publicly distribute files they are explicitly blocked from downloading directly. The issue was fixed in version 2.62.0.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized data exfiltration by bypassing intended access controls. Any authenticated user with share privileges but without download privileges can access and publicly distribute files they should not be able to download.

• Unauthorized users can retrieve sensitive file contents via public share links.
• It breaks data loss prevention controls by allowing restricted users to leak files.
• It undermines role separation policies by allowing users to circumvent download restrictions.
• The vulnerability has a moderate severity with a CVSS v3 base score of 6.5.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by testing whether users with share privileges but without download privileges can access file contents via public share links.'}, {'type': 'list_item', 'content': 'Create a non-admin user with perm.share = true and perm.download = false.'}, {'type': 'list_item', 'content': 'Upload a file (e.g., a PDF) using this user.'}, {'type': 'list_item', 'content': "Attempt a direct raw download using a command like: curl -i -X GET https://<filebrowser-host>/api/raw/<filename> -H 'Authorization: Bearer <token>' (expected to be denied)."}, {'type': 'list_item', 'content': "Create a share link for the file using: curl -i -X POST https://<filebrowser-host>/api/share/<filename> -H 'Authorization: Bearer <token>'."}, {'type': 'list_item', 'content': 'Attempt to download the file publicly without authentication using: curl -i -X GET https://<filebrowser-host>/api/public/dl/<hash>.'}, {'type': 'paragraph', 'content': 'If the public download returns the file content (HTTP 200), the vulnerability is present.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation is to upgrade File Browser to version 2.62.0 or later, where the vulnerability has been fixed.

The fix enforces that users must have both share and download permissions to create share links, preventing unauthorized file exfiltration.

If upgrading immediately is not possible, consider restricting share privileges to only users who also have download permissions as a temporary workaround.

Monitor and audit share link creation and public downloads to detect any unauthorized access.

Useful 0 Not Useful 0