-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/filebrowser/filebrowser | go | <= 2.39.0 |
Miggo AIRoot Cause AnalysisAn analysis of the provided Go code from filebrowser/filebrowser reveals a critical vulnerability in its authentication mechanism. The core of the issue lies in how JSON Web Tokens (JWTs) are managed, specifically the lack of a server-side invalidation process upon user logout. This allows for session replay attacks using JWTs that are still valid even after a user has explicitly logged out.
The function http.withUser serves as a middleware for authenticating user requests. Its responsibility is to validate the JWT presented by the user. However, its validation logic is insufficient. It primarily checks for two conditions:
Crucially, it does not consult a token blacklist or any other mechanism to determine if the user has logged out. Consequently, any JWT, once issued, remains valid until its natural expiration, regardless of logout events. An attacker who captures a user's JWT can therefore continue to access the system on their behalf.
The http.loginHandler function is the entry point for this vulnerability. It authenticates users and, upon success, calls http.printToken to generate and issue the JWT. This token is then susceptible to the replay attack.
Similarly, the http.renewHandler is also implicated. It allows a user with a valid, soon-to-expire token to obtain a new one. This is part of the token lifecycle management that is missing the critical invalidation step.
To mitigate this vulnerability, the application should implement a server-side mechanism to track active sessions or maintain a blacklist of invalidated tokens. When a user logs out, their token should be added to this blacklist. The http.withUser function must then be updated to check this blacklist during token validation, ensuring that logged-out sessions cannot be reused.
KEV Misses 88% of Exploited CVEs- Get the report