| tiêu đề | vastsa FileCodeBox 2.0.0-dev (main branch, ~2026-06-19) CWE-362 (Race Condition — TOCTOU) + CWE-840 (Business Logic Erro |
|---|
| Mô tả | FileCodeBox's file share "pickup count limit" (expired_count) has multiple bypass vulnerabilities: (1) [CRITICAL] TOCTOU Race Condition — update_file_usage performs a non-atomic read-modify-write, N concurrent requests all read the same expired_count and all pass the check, allowing a count=1 file to be retrieved N times; (2) [HIGH] Reusable Download URL — download_file only validates a time-based token without calling update_file_usage, so a single select yields a URL that can be reused unlimited times within an ~1000-second window; (3) [HIGH] Missing Expiry Check — download_file calls get_code_file_by_code with check=False, completely skipping the is_expired() check; (4) [HIGH] Share Code Enumeration (IDOR) — default 5-digit numeric codes (90,000 possibilities), GET /share/metadata/ requires no authentication and successful probes are not rate-limited, allowing attackers to enumerate the entire code space and discover all shared files. All vulnerabilities are remotely exploitable without authentication. |
|---|
| Nguồn | ⚠️ https://github.com/vastsa/FileCodeBox/issues/482 |
|---|
| Người dùng | Galaxyn (UID 98388) |
|---|
| Đệ trình | 15/07/2026 02:12 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 29/08/2026 19:47 (2 months later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 397060 [vastsa FileCodeBox đến 2.3 Pickup Limit apps/base/views.py update_file_usage điều kiện tranh chấp] |
|---|
| điểm | 20 |
|---|