T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:252- Finding
Operational Examples Bypass the Configured FileBrowser Scope
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 252–256
Vulnerability Type: Scope enforcement bypass in documented API commands
Risk Level: MediumVulnerable Code
bash # List the root directory curl -s -H "X-Auth: $TOKEN" "$BASE/api/resources?path=/" # Upload echo "hello" | curl -s -X POST "$BASE/api/resources/hello.txt?override=true" \ -H "X-Auth: $TOKEN" -H "Content-Type: text/plain" --data-binary @-Technical Analysis
The Skill states that all FileBrowser operations must remain under the directory configured by
scope. However, the operational examples violate that security boundary in two ways:GET /api/resources?path=/enumerates the FileBrowser root rather than the configured scope.POST /api/resources/hello.txtuploads a file directly to the root because the resource path lacks the required scope prefix.
These examples are part of the Agent-facing instructions and may therefore be copied or followed during real operations. The restriction is only expressed as a textual rule; the examples do not normalize or validate paths before issuing requests. The authenticated FileBrowser account, rather than the Skill’s declared scope, consequently becomes the effective access boundary.
Attack Path
- A FileBrowser account with access beyond the configured scope is supplied to the Skill.
- A user asks the Agent to list files or upload a resource using the documented curl workflow.
- The Agent follows the examples and sends a request using
path=/or/api/resources/hello.txt. - FileBrowser authorizes the request according to the account’s server-side privileges.
- Root-level metadata is returned or a file is written outside the user-approved scope.
No server vulnerability is required; exploitation relies on the discrepancy between the declared scope restriction and the documented commands.
Impact Assessment
An Agent following these examples may:
- Enumerate names and metadata of resources ...[truncated 457 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the root-listing example with a request that uses the configured and validated scope:
bash curl -sG -H "X-Auth: $TOKEN" \ --data-urlencode "path=$FB_SCOPE" \ "$BASE/api/resources"- Prefix every upload, download, deletion, sharing, and directory-creation path with the validated scope:
bash curl -s -X POST \ "$BASE/api/resources/${FB_SCOPE#/}/hello.txt?override=true" \ -H "X-Auth: $TOKEN" \ -H "Content-Type: text/plain" \ --data-binary @--
Require
FB_SCOPEor the equivalent configuration value to be present before any resource operation. Fail closed when it is absent or invalid. -
Normalize paths before requests, reject
.., encoded traversal sequences, absolute-path ambiguity, and any normalized path that is not equal to or beneath the configured scope. -
Use one shared path-validation routine for listing, upload, download, deletion, movement, directory creation, and share creation.
-
Remove
override=truefrom generic examples or require explicit user confirmation before overwriting an existing resource. -
Configure the FileBrowser account itself with server-side permissions restricted to the same scope, ensuring that a documentation or validation mistake cannot access broader resources.