FileBrowser Quantum Path Traversal Vulnerability in Subtitles Handler Allows Arbitrary File Read

A path traversal vulnerability has been identified in FileBrowser Quantum versions prior to 1.4.3-beta. The issue resides in the 'subtitlesHandler' endpoint, specifically 'GET /api/media/subtitles', where two user-controlled query parameters, 'path' and 'name', are used in filesystem operations without proper sanitization. This oversight creates two independent path traversal vectors. The primary vector involves the 'path' parameter, which is passed directly to 'idx.GetRealPath()' without being sanitized, enabling an attacker to escape the storage root and manipulate the 'parentDir' variable to point to any directory on the host. The secondary vector involves the 'name' parameter, which is concatenated with 'parentDir' using 'filepath.Join' without removing directory components, allowing traversal relative to any resolved 'parentDir'. Any authenticated user can exploit these vectors to read any text file accessible by the server process, including sensitive files like '/etc/passwd', SSH keys, database credentials, and JWT signing keys.

Impact

Exploitation of this vulnerability leads to unauthorized reading of arbitrary files on the host filesystem, bypassing user scope restrictions and potentially exposing sensitive information such as application configuration files, database passwords, API keys, and JWT signing secrets. In applications where the JWT signing key is accessible, this could allow an attacker to forge admin tokens, escalating privileges.

Reproduction

To reproduce the vulnerability, log into the application as an authenticated user. Then, send a request to the 'GET /api/media/subtitles' endpoint with a crafted 'path' parameter that includes directory traversal sequences (such as '../../etc/passwd'). The response will include the contents of the '/etc/passwd' file, demonstrating the path traversal exploit. Alternatively, the 'name' parameter can be used for traversal by first establishing a valid 'path' anchor that points to a file within the user's scope.

Remediation

Users are advised to update to FileBrowser Quantum version 1.4.3-beta, which addresses the vulnerability by sanitizing the 'path' parameter and stripping directory components from the 'name' parameter to prevent traversal.