PT-2022-12690 · Unknown · Filebrowser

Febin · Published 2022-02-04 · Updated 2022-03-04 · CVE-2021-46398

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Filebrowser versions prior to 2.18.0

Description A Cross-Site Request Forgery vulnerability exists in Filebrowser that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim. This can lead to Remote Code Execution (RCE) as an admin can run commands using the FileBrowser.

Recommendations For versions prior to 2.18.0, update to version 2.18.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the FileBrowser to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-46398

GHSA-72WF-HWCQ-65H9

GO-2022-0563

Affected Products

Filebrowser

References · 16

• 🔥 https://github.com/febinrev/CVE-2021-46398_Chamilo-LMS-RCE · Exploit
• 🔥 https://exploit-db.com/exploits/50717 · Exploit
• 🔥 https://febinj.medium.com/critical-csrf-to-rce-in-filebrowser-865a3c34b8e7 · Exploit
• 🔥 http://packetstormsecurity.com/files/165885/FileBrowser-2.17.2-Code-Execution-Cross-Site-Request-Forgery.html · Exploit
• 🔥 https://febin0x4e4a.blogspot.com/2022/01/critical-csrf-in-filebrowser.html · Exploit
• 🔥 https://febin0x4e4a.wordpress.com/2022/01/19/critical-csrf-in-filebrowser · Exploit
• 🔥 https://systemweakness.com/critical-csrf-to-rce-in-filebrowser-865a3c34b8e7 · Exploit
• https://github.com/filebrowser/filebrowser/commit/74b7cd8e81840537a8206317344f118093153e8d · Patch
• https://osv.dev/vulnerability/CVE-2021-46398 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-72wf-hwcq-65h9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46398 · Security Note
• https://osv.dev/vulnerability/GO-2022-0563 · Vendor Advisory
• https://github.com/filebrowser/filebrowser · Note
• https://github.com/filebrowser/filebrowser/issues/1621 · Note
• https://pkg.go.dev/vuln/GO-2022-0563 · Note