Improper Authorization in File Browser Direct-Upload Endpoint

File Browser versions 2.5.0 through 2.63.23 contain an incorrect authorization flaw within the direct-upload endpoint, specifically located in the resourcePostHandler function of http/resource.go. The vulnerability allows an authenticated user with standard Create and Modify permissions to initiate a recursive deletion of directories they are not authorized to remove. When a POST request with the override=true parameter is sent to an existing directory, the application attempts to open the directory for writing. This operation fails, triggering a cleanup path that executes Fs.RemoveAll on the request path. Crucially, this cleanup routine bypasses the standard Perm.Delete permission check and the checkDescendants rule walk, leading to unintended file system modification. While the impact remains confined to the user's defined scope, an attacker can delete directories and files that should be restricted by rule-denied access controls. This vulnerability was introduced in version 2.5.0 and remains unpatched.

Attack Chain

1. Attacker authenticates to the File Browser application with an account possessing only Create and Modify permissions.
2. Attacker identifies a target directory within their scoped environment that contains sensitive or protected files.
3. Attacker constructs a malicious HTTP POST request targeting the direct-upload endpoint.
4. Attacker includes the query parameter override=true in the request path, pointing to the target directory.
5. The server-side resourcePostHandler receives the request and attempts to execute a write operation on the target path.
6. The application fails to write to the directory because it is not a file, triggering the Fs.RemoveAll cleanup mechanism.
7. The system recursively deletes the target directory and its contents, bypassing standard delete authorization checks.

Impact

Successful exploitation allows authenticated, low-privileged users to perform unauthorized recursive deletions of directories and files within their scope. This impact could lead to significant data loss or the removal of rule-denied configuration files, causing disruption to service or access control integrity within the application. The vulnerability affects all users running vulnerable versions (2.5.0 through 2.63.23) and currently lacks a vendor-supplied patch.

Recommendation

Prioritize monitoring of unauthorized deletion attempts within the File Browser application.

• Implement strict auditing of POST requests to the direct-upload endpoint, specifically flagging those containing the override=true query parameter.
• Monitor web server logs for HTTP 500 status codes originating from the direct-upload endpoint that correlate with attempted directory write operations.
• Restrict access to File Browser instances until a patch is provided by the vendor, as no current mitigation is available.