GHSA-RMWH-G367-MJ4X
Vulnerability from github – Published: 2025-06-30 17:44 – Updated: 2025-08-04 17:22Summary
URLs that are accessed by a user are commonly logged in many locations, both server- and client-side. It is thus good practice to never transmit any secret information as part of a URL. The Filebrowser violates this practice, since access tokens are used as GET parameters.
Impact
The JSON Web Token (JWT) which is used as a session identifier will get leaked to anyone having access to the URLs accessed by the user. This will give the attacker full access to the user's account and, in consequence, to all sensitive files the user has access to.
Description
Sensitive information in URLs is logged by several components (see the following examples), even if access is protected by TLS.
- The browser history
- The access logs on the affected web server
- Proxy servers or reverse proxy servers
- Third-party servers via the HTTP referrer header
In case attackers can access certain logs, they could read the included sensitive data.
Proof of Concept
When a file is downloaded via the web interface, the JWT is part of the URL:
GET /api/raw/testdir/testfile.txt?auth=eyJh[...]_r4EQ HTTP/1.1
Host: filebrowser.local:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://filebrowser.local:8080/files/testdir/
Cookie: auth=eyJh[...]_r4EQ
Upgrade-Insecure-Requests: 1
Priority: u=0, i
This also happens when a new command session is started:
GET /api/command/?auth=eyJh[...]YW8BA HTTP/1.1
Host: filebrowser.local:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: http://filebrowser.local:8080
Sec-WebSocket-Key: oqQMrF7R34D3lAkj1+ZHTw==
Connection: keep-alive, Upgrade
Cookie: auth=eyJh[...]YW8BA
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
Recommended Countermeasures
Sensitive data like session tokens or user credentials should be transmitted via HTTP headers or the HTTP body only, never in the URL.
Timeline
2025-03-27Identified the vulnerability in version 2.32.02025-04-11Contacted the project2025-04-29Vulnerability disclosed to the project2025-06-25Uploaded advisories to the project's GitHub repository2025-06-26CVE ID assigned by GitHub2025-06-26Fix released in version 2.33.9
References
Credits
- Mathias Tausig (SBA Research)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/filebrowser/filebrowser/v2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.33.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/filebrowser/filebrowser"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.11.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-52901"
],
"database_specific": {
"cwe_ids": [
"CWE-598"
],
"github_reviewed": true,
"github_reviewed_at": "2025-06-30T17:44:36Z",
"nvd_published_at": "2025-06-30T20:15:25Z",
"severity": "MODERATE"
},
"details": "## Summary\n\nURLs that are accessed by a user are commonly logged in many locations, both server- and client-side. It is thus good practice to never transmit any secret information as part of a URL. The *Filebrowser* violates this practice, since access tokens are used as GET parameters.\n\n## Impact\n\nThe *JSON Web Token (JWT)* which is used as a session identifier will get leaked to anyone having access to the URLs accessed by the user. This will give the attacker full access to the user\u0027s account and, in consequence, to all sensitive files the user has access to.\n\n## Description\n\nSensitive information in URLs is logged by several components (see the following examples), even if access is protected by TLS.\n\n* The browser history\n* The access logs on the affected web server\n* Proxy servers or reverse proxy servers\n* Third-party servers via the HTTP referrer header\n\nIn case attackers can access certain logs, they could read the included sensitive data.\n\n## Proof of Concept ##\n\nWhen a file is downloaded via the web interface, the JWT is part of the URL:\n\n```http\nGET /api/raw/testdir/testfile.txt?auth=eyJh[...]_r4EQ HTTP/1.1\nHost: filebrowser.local:8080\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nConnection: keep-alive\nReferer: http://filebrowser.local:8080/files/testdir/\nCookie: auth=eyJh[...]_r4EQ\nUpgrade-Insecure-Requests: 1\nPriority: u=0, i\n```\n\nThis also happens when a new *command session* is started:\n\n```http\nGET /api/command/?auth=eyJh[...]YW8BA HTTP/1.1\nHost: filebrowser.local:8080\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0\nAccept: */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nSec-WebSocket-Version: 13\nOrigin: http://filebrowser.local:8080\nSec-WebSocket-Key: oqQMrF7R34D3lAkj1+ZHTw==\nConnection: keep-alive, Upgrade\nCookie: auth=eyJh[...]YW8BA\nPragma: no-cache\nCache-Control: no-cache\nUpgrade: websocket\n```\n\n## Recommended Countermeasures ##\n\nSensitive data like session tokens or user credentials should be transmitted via HTTP headers or the HTTP body only, never in the URL.\n\n## Timeline ##\n\n* `2025-03-27` Identified the vulnerability in version 2.32.0\n* `2025-04-11` Contacted the project\n* `2025-04-29` Vulnerability disclosed to the project\n* `2025-06-25` Uploaded advisories to the project\u0027s GitHub repository\n* `2025-06-26` CVE ID assigned by GitHub\n* `2025-06-26` Fix released in version 2.33.9\n\n## References ##\n\n* [CWE-598: Use of GET Request Method With Sensitive Query Strings](https://cwe.mitre.org/data/definitions/598.html)\n* [Original Advisory](https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250327-03_Filebrowser_Sensitive_Data_Transferred_In_URL)\n\n## Credits ##\n\n* Mathias Tausig ([SBA Research](https://www.sba-research.org/))",
"id": "GHSA-rmwh-g367-mj4x",
"modified": "2025-08-04T17:22:24Z",
"published": "2025-06-30T17:44:36Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-rmwh-g367-mj4x"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52901"
},
{
"type": "WEB",
"url": "https://github.com/filebrowser/filebrowser/commit/d5b39a14fd3fc0d1c364116b41289484df7c27b2"
},
{
"type": "PACKAGE",
"url": "https://github.com/filebrowser/filebrowser"
},
{
"type": "WEB",
"url": "https://github.com/filebrowser/filebrowser/releases/tag/v2.33.9"
},
{
"type": "WEB",
"url": "https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250327-03_Filebrowser_Sensitive_Data_Transferred_In_URL"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2025-3794"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "File Browser allows sensitive data to be transferred in URL"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.