Symlink Bypass in File Browser via ScopedFs

Executive Summary

The vulnerability exists in File Browser versions prior to 2.63.16 within the ScopedFs component. It occurs because the system validates the nearest existing ancestor directory of a dangling symlink (a symlink pointing to a non-existent target) rather than the symlink itself during file creation operations.

This flaw allows an authenticated user with Create and Modify permissions to exploit dangling symlinks to create files outside their authorized scope. Essentially, by creating a dangling symlink inside their allowed directory that points to an out-of-scope location, the user can write attacker-controlled files anywhere writable on the system, including locations belonging to other users.

The issue is fixed in version 2.63.16 by properly validating symlink targets and preventing scope escapes through dangling symlinks.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows authenticated users to create attacker-controlled files outside their designated scope, including in other users' directories. This unauthorized file creation could lead to data integrity issues and potential unauthorized data access or modification.

Such unauthorized file operations may impact compliance with standards like GDPR and HIPAA, which require strict access controls and data integrity protections to prevent unauthorized data manipulation or exposure.

By enabling cross-tenant file creation and scope escapes, the vulnerability could undermine the enforcement of data segregation and access policies mandated by these regulations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the exploitation of dangling symlinks within the File Browser application to create files outside a user's scope. Detection would involve identifying the presence of dangling symlinks that point outside the allowed directory scope and monitoring file creation requests that follow these symlinks.

Since the vulnerability is specific to File Browser versions prior to 2.63.16, the first step is to verify the version of File Browser running on your system.

• Check the File Browser version to confirm if it is older than 2.63.16.
• Scan the file system within the File Browser scope for dangling symlinks (symlinks pointing to non-existent targets). For example, on a Unix-like system, you can use the command: find /path/to/filebrowser/root -xtype l
• Inspect logs or monitor API calls to endpoints like POST /api/resources/ for suspicious file creation activities that might be targeting paths outside the user’s scope.

There are no specific commands provided in the resources for detecting exploitation attempts, but the above steps can help identify potential indicators of this vulnerability.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have significant security impacts by allowing an authenticated user to create arbitrary files outside their designated scope.

• An attacker can write malicious or unauthorized files into directories they should not have access to.
• It can lead to cross-tenant attacks where one user writes files into another user's directory.
• This unauthorized file creation can be used to escalate privileges, inject malicious code, or disrupt system operations.

Overall, it compromises the integrity and isolation guarantees of the file management system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade File Browser to version 2.63.16 or later, where the issue has been fixed.

The fix prevents writes through dangling symlinks that escape the user's scope by properly validating symlink targets before allowing file creation.

Additionally, the update handles relative symlinks correctly and blocks delete operations that could escape the scope via symlinked ancestors.

Useful 0 Not Useful 0