CVE-2021-46398

published 2022-02-04

CVE-2021-46398: A Cross-Site Request Forgery vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor user with admin privilege and get access…

Priority P2 58 high 8.8 CVSS 3.1

AV N AC L PR N UI R S U C H I H A H

EXPLOIT

A Cross-Site Request Forgery vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim. An admin can run commands using the FileBrowser and hence it leads to RCE.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
filebrowser	filebrowser	< 2.18.0	2.18.0
github.com	filebrowser_filebrowser_v2	>= 0 < 2.18.0	2.18.0

Detection & IOCs extracted from sources · hover to see the quote

url /api/users↗

cookie auth=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjp7ImlkIjoxLCJsb2NhbGUiOiJlbiIsInZpZXdNb2RlIjoibW9zYWljIiwic2luZ2xlQ2xpY2siOmZhbHNlLCJwZXJtIjp7ImFkbWluIjp0cnVlLCJleGVjdXRlIjp0cnVlLCJjcmVhdGUiOnRydWUsInJlbmFtZSI6dHJ1ZSwibW9kaWZ5Ijp0cnVlLCJkZWxldGUiOnRydWUsInNoYXJlIjp0cnVlLCJkb3dubG9hZCI6dHJ1ZX0sImNvbW1hbmRzIjpbXSwibG9ja1Bhc3N3b3JkIjpmYWxzZSwiaGlkZURvdGZpbGVzIjpmYWxzZX0sImV4cCI6MTY0NDA4OTE3MiwiaWF0IjoxNjQ0MDgxOTcyLCJpc3MiOiJGaWxlIEJyb3dzZXIifQ.hdFWg3SIQQ-4P8K48yru-152NGItZPKau6EBL6m8RJE↗

command {"what":"user","which":[],"data":{"scope":"../../../../root/","locale":"en","viewMode":"mosaic","singleClick":false,"sorting":{"by":"","asc":false},"perm":{"admin":true,"execute":true,"create":true,"rename":true,"modify":true,"delete":true,"share":true,"download":true},"commands":[],"hideDotfiles":false,"username":"pwned","password":"","rules":[{"allow":true,"path":"../","regex":false,"regexp":{"raw":""}}],"lockPassword":false,"id":0,"password":"pwned"}}=test↗

path ../../../../root/↗

• → Alert on cross-site POST requests to /api/users where Sec-Fetch-Site is 'cross-site' and Sec-Fetch-Mode is 'navigate', indicating a CSRF-driven user creation attempt. ↗
• → Flag POST /api/users payloads containing 'admin':true and 'execute':true in the perm object, especially when submitted with Content-Type: text/plain — this indicates backdoor admin account creation. ↗
• → Detect directory traversal sequences (e.g., ../../../../) in the 'scope' field of POST /api/users requests, indicating an attempt to grant a new user access to sensitive filesystem paths such as /root/. ↗
• → Monitor for new user creation via /api/users where the username is a known attacker-controlled value (e.g., 'pwned') and the rules array contains path traversal entries like '../'. ↗

• · FileBrowser's admin command execution capability is what elevates this CSRF to full RCE — any deployment where admin users can run commands is at maximum risk. ↗

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvd v2.0 6.8 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-352