PT-2021-21872 · Unknown · Filebrowser

Omriinbar · Published 2021-08-31 · Updated 2021-12-08 · CVE-2021-37794

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: FileBrowser versions prior to 2.16.0

Description: A stored cross-site scripting (XSS) issue exists that allows an authenticated user to upload a malicious .svg file, which acts as a stored XSS payload. If triggered by an administrator, this payload can execute malicious OS commands on the server running the FileBrowser instance.

Recommendations: For versions prior to 2.16.0, update to version 2.16.0 or later to resolve the issue. As a temporary workaround, consider restricting the ability to upload .svg files or disabling the upload feature for authenticated users until a patch is applied. Restrict access to the FileBrowser instance to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-37794

Affected Products

Filebrowser

References · 8

• https://github.com/filebrowser/filebrowser/commit/201329abce4e92ae9071b9ded81e267aae159fbd · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-37794 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37794 · Vendor Advisory
• https://github.com/filebrowser/filebrowser · Note
• https://t.me/cibsecurity/28132 · Telegram Post
• https://t.me/poxek/222 · Telegram Post
• https://gist.github.com/omriinbar/1e28649f31d795b0e9b7698a9d255b5c · Note
• https://t.me/securixy_kz/666 · Telegram Post