| शीर्षक | error311 FileRise 3.20.0 Authentication Bypass |
|---|
| विवरण | The disableBasicAuth, disableFormLogin, and disableOIDCLogin configuration flags are enforced only client-side via JavaScript. There is zero server-side enforcement. An attacker bypasses these restrictions by sending requests directly to the backend API endpoints. Vulnerable code in src/FileRise/Http/Controllers/AuthController.php: loginBasic() at line 761, handleFormLogin() at line 506, handleOidcFlow() at line 177. None of these methods check the corresponding disable flag. These flags exist only in AdminModel.php and admin JavaScript (hides UI buttons). PoC: curl -s http://127.0.0.1:8080/api/auth/login_basic.php -H 'Authorization: Basic YXR0YWNrZXI6UGFzc3dvcmQxMjMh' returns 302 despite disableBasicAuth=true.
|
|---|
| स्रोत | ⚠️ https://github.com/error311/FileRise/security/advisories/GHSA-p9qc-2r93-jccq |
|---|
| उपयोगकर्ता | BRabbit (UID 99520) |
|---|
| सबमिशन | 03/07/2026 08:34 AM (2 महीनों पहले) |
|---|
| संयम | 19/08/2026 06:33 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 393207 [error311 FileRise तक 3.20.0 API AuthController.php loginBasic/handleFormLogin/handleOidcFlow कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|