Horizon Alert
Summary of the vulnerability and why it matters
A critical vulnerability has been identified in FileBrowser Quantum, a self-hosted web-based file manager. The issue allows unauthorized modification, copying, or renaming of files within a user's shared directory via a public share link. This vulnerability is similar to a previously addressed issue, indicating a potential pattern in how file operations are handled.
- Path traversal allows unauthorized file tampering.
- Critical flaw impacts self-hosted file management.
- Confirm relevance and verify exposure.
Attack Path
How an attacker could exploit the issue
An attacker can leverage a public share link with modification capabilities to execute a path traversal attack. This allows them to manipulate files outside of the intended shared directory by crafting specific `fromPath` and `toPath` requests. The vulnerability lies in how user-provided paths are processed before sanitization, enabling actions like moving, copying, or renaming files across the entire source root of the share owner.
- Requires a public share link with modification enabled.
- Triggers when handling file move/copy/rename operations.
- Allows arbitrary file manipulation within the share owner's root.
Live Threat
Current exploitation, exposure, and threat context
When supported by the advisory's configuration, an attacker with a public share link that allows modification could move, copy, or rename arbitrary files within the owner's shared directory. This occurs because the application incorrectly handles path traversal before sanitizing user-supplied file paths.
- Files within the shared directory.
- Via a crafted public share link.
- Unauthorized file manipulation.
Operational Fix
Recommended remediation, mitigation, and detection steps
The Platform team is likely responsible for managing the self-hosted FileBrowser Quantum instances. The initial focus should be on identifying all deployed instances, confirming their exposure and criticality, and then coordinating with application owners or vendor management to plan the update.
- Platform or application owners should lead.
- Verify public share links with modification enabled.
- Plan and execute version updates.
