Listen to this Post
How the CVE Works
File Browser’s authentication flaw allows long-lived JWT tokens to remain valid post-logout due to missing server-side invalidation. When a user logs in, a JWT is issued via /api/login, but logging out doesn’t revoke it. The backend only checks token expiry (VerifyExpiresAt) and user store timestamps (LastUpdate), not active sessions. Attackers can replay captured tokens indefinitely until natural expiration, enabling session hijacking. The `auth.go` code lacks token blacklisting, relying solely on client-side expiry checks.
DailyCVE Form
Platform: File Browser
Version: <= v2.23.0
Vulnerability: JWT persistence
Severity: Critical
Date: 2023-XX-XX
Prediction: Patch by Q1 2024
What Undercode Say
docker run -v filebrowser_data:/srv -v filebrowser_database:/database -v filebrowser_config:/config -p 8080:80 filebrowser/filebrowser
// auth.go flaw expired := !tk.VerifyExpiresAt(time.Now().Add(time.Hour), true) updated := tk.IssuedAt != nil && tk.IssuedAt.Unix() < d.store.Users.LastUpdate(tk.User.ID)
How Exploit
1. Capture JWT via `/api/login`.
2. Logout victim.
3. Replay token to `/api/resources`.
Protection from this CVE
- Implement token blacklisting.
- Shorten JWT expiry.
- Use refresh tokens.
Impact
- Session hijacking.
- OWASP A2:2021 violation.
- Indefinite token reuse.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
