File Deletion via Symlink in FileBrowser Before 2.63.19

Executive Summary

This vulnerability affects filebrowser versions before 2.63.19. It involves an out-of-scope file deletion flaw in the TUS upload cache eviction mechanism. Authenticated users with only Create permission can delete arbitrary files outside their designated scope by exploiting a symlink attack. Attackers swap an ancestor directory with a symlink during the cache TTL window, redirecting the os.Remove call to unintended targets, bypassing security checks.

Useful 0 Not Useful 0

Detection Guidance

Check filebrowser version with 'filebrowser version' or inspect running processes for filebrowser. Monitor for unexpected file deletions or symlink creation in upload directories. Review logs for TUS upload cache eviction errors or os.Remove calls targeting unintended paths.

Useful 0 Not Useful 0

Impact Analysis

An attacker could delete critical files outside their permissions, including other users' data or application files like filebrowser.db. This could lead to data loss, service disruption, or unauthorized access to sensitive information. The attack requires low privileges and network access but no user interaction.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file deletion or data exposure, violating GDPR's integrity and confidentiality principles or HIPAA's access controls. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches or loss of protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade filebrowser to version 2.63.19 or later immediately. Restrict Create permission users to trusted accounts. Disable TUS upload cache if not required. Implement filesystem monitoring for symlink changes in upload directories.

Useful 0 Not Useful 0