FileBrowser CVE-2024-54204: Symlink Directory Scope Bypass RCE/Privilege Escalation

Vulnerability Overview Title: Symlinked directories allow scoped users and public-share recipients to read and write files outside their scope Description: Vulnerability Type: Symbolic link directories enable scoped users and public share recipients to read and write files beyond their designated scope. Affected Versions: (Go) <= 2.63.13 Fixed Version: 2.63.14 Severity: High (7.5 / 10) Impact Scope Multi-user deployments: Boundaries can be crossed when symbolic links (Variant 1) or directory symbolic links (Variant 2) exist within a restricted user's scope tree and resolve to locations outside the scope but accessible by the server process. Specific Impacts: - Reading file contents and metadata outside the scope. - Overwriting targets outside the scope. - Creating or overwriting targets outside the scope via TUS resumable uploads. - Creating public shares for targets outside the scope. - For Variant 2, the same exposure allows regular public share recipients to read standard files within the symlink subtree and view the target file in the public share's archive download. Remediation Resolve Symbolic Links: Resolve symbolic links and verify that the resolved target remains within the user's true scope root before performing file operations (serving, sharing, writing, truncating, renaming, copying, or deleting). Specific Steps: - Call (resolving each path component with ) to all paths, not only when the final component is a symbolic link. - Add a check in / for and to ensure that non-existing leaf nodes do not bypass container validation. - Omit entries from whose resolved targets fall outside the scope, and skip them in . - Apply the same post-resolution path check to public shares and public share serving. - As an alternative or defense-in-depth measure, reject symbolic links for operations unless explicitly enabled by an administrator option. Regression Testing: Cover symlink reading, overwriting, TUS resumable uploads, and public sharing (download, share, list, and archive read paths), along with existing point-to-point controls. Include a positive test to confirm that symlinks legitimately within the scope remain functional. POC Code Additional Information CVSS v3 base metrics: - Attack vector: Network - Attack complexity: Low - Privileges required: None - User interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: None CVE ID: CVE-2024-54204 Credits: - DavidCarlez (Reporter) - hackde (Remediation Reviewer) - m2h2z (Reporter) - alanturing81 (Reporter) Limitations and Disclaimers: - This is not a generic path traversal, nor a dot-dot or encoded dot-dot control issue; these controls remain effective at the routing level. - This is not a proxy-side obfuscation issue; the proof uses normal authorized requests for the restricted user (and for Variant 2, for the regular public share recipient). - The proof assumes that relevant symbolic links already exist within the scope tree, or that another known workflow in the deployment can place them—such as an SMB/NFS export, a Docker bind mount, or a link created by an administrator. The creation of symlinks via the Web UI alone is not demonstrated.

Goal Reached Thanks to every supporter — we hit 100%!

FileBrowser CVE-2024-54204: Symlink Directory Scope Bypass RCE/Privilege Escalation

More from this source