GHSA-vx2m-jpxr-xv7w

Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint

Published

2026-08-24

Modified

2026-08-24

Sources

github-advisory

Summary

## Summary Cloudreve's file-listing responses hand the client a `context_hint` (UUID) that is meant to speed up follow-up operations. When that hint is replayed on the `file/url` (and `file/thumb`) routes, DBFS caches a `shareNavigatorState` containing the already-loaded share root and share row. On a later request carrying the same hint, `shareNavigator.RestoreState` repopulates `shareRoot`, and `shareNavigator.To` then **skips `Root`**. `Root` is the only place that re-checks `inventory.IsValidShare` (share expiry, remaining-download count, owner status, source-file validity) and the share password. As a result, a recipient who prewarms a context hint while access is valid can keep minting signed file URLs for already-known shared file paths for up to the context-hint TTL (`5 * 60` = 300 s) after the owner deletes the share or the share expires — plus the lifetime of any signed entity URL minted in that window. This is a **revocation / expiry bypass**, not a way to discover unknown share contents: the attacker must already have had access to the share and must know the target file URI from a prior listing. ## Root cause (verified at `26b6b10`) **1. List responses leak the hint and each file URI** — `service/explorer/response.go` populates `ListResponse.ContextHint` and `FileResponse.Path` (`f.Uri(false).String()`). **2. `file/url` and `file/thumb` accept the client-supplied hint** — `routers/router.go:631` and `:662`: ```go file.POST("url", middleware.ContextHint(), /* ... */ controllers.FileURL) file.GET("thumb", middleware.ContextHint(), /* ... */ controllers.Thumb) ``` The `file` group's only auth gate is `middleware.RequiredScopes(types.ScopeFilesRead)` — there is **no** independent share-validation middleware on this route. All share validation lives inside DBFS. **3. The middleware trusts the header verbatim** — `middleware/file.go:41`: ```go func ContextHint() gin.HandlerFunc { return func(c *gin.Context) { if c.GetHeader(dbfs.ContextHintHeader) != "" { // X-Cr-Context-Hint util.WithValue(c, dbfs.ContextHintCtxKey{}, uuid.FromStringOrNil(c.GetHeader(dbfs.ContextHintHeader))) } c.Next() } } ``` **4. DBFS restores cached navigator state on a hint hit** — `dbfs.go:745` (`ContextHintTTL = 5 * 60`, `dbfs.go:34`). On a miss it arms `PersistState`; the closure fires in `DBFS.Recycle()` at end of request. **5. Persisted share state carries the loaded `shareRoot` + `share` row** — `share_navigator.go:72`/`:85`. `RestoreState` reinstates `n.shareRoot`, `n.share`, `n.owner`, etc. **6. `Root` is the sole validity/password gate** — `share_navigator.go:114` → `inventory.IsValidShare(share)` (`inventory/share.go:227`: `IsShareExpired` checks `Expires.Before(now)` **and** `RemainDownloads NOT nil => Root() skipped root, err := n.Root(ctx, path) ... } ... } ``` The single-file-share branch is **also** affected: it calls `latestSharedSingleFile`, which fetches `n.fileClient.GetByID(n.share.Edges.File.ID)` straight from the restored `share` with no revalidation (`share_navigator.go`). **8. A failed download hook does not block URL issuance** — `pkg/filemanager/manager/entity.go:250`: ```go if err := m.fs.ExecuteNavigatorHooks(ctx, fs.HookTypeBeforeDownload, file); err != nil { m.l.Warning("Failed to execute navigator hooks: %s", err) // logged, NOT fatal } ``` The share's `BeforeDownload` hook is `shareClient.Downloaded()` (`UpdateOneID(share.ID).AddDownloads(1).AddRemainDownloads(-1)`). Against a deleted share this update errors, but the error is only logged and the signed URL is still minted. The signed content endp

Affected packages

Remediation: No patched version is listed by GitHub.

References

• https://github.com/advisories/GHSA-vx2m-jpxr-xv7w