Summary
FileRise WebDAV authentication can bypass a configured TOTP requirement by validating only the account's username and password. An attacker who obtains valid primary credentials for a TOTP-enabled account may access the enabled WebDAV service and perform actions allowed by that account's file permissions.
FileRise WebDAV authentication can bypass a configured TOTP requirement by validating only the account's username and password. An attacker who obtains valid primary credentials for a TOTP-enabled account may access the enabled WebDAV service and perform actions allowed by that account's file permissions.
Affected context
The issue occurs in FileRise deployments where WebDAV is enabled and accounts use TOTP as an additional authentication factor. The browser-based login flow enforces TOTP, but the separate WebDAV authentication callback may authenticate users after checking only primary credentials.
The issue occurs in FileRise deployments where WebDAV is enabled and accounts use TOTP as an additional authentication factor. The browser-based login flow enforces TOTP, but the separate WebDAV authentication callback may authenticate users after checking only primary credentials.
Exploit preconditions
- Attack surface: FileRise WebDAV service
- Required access: Knowledge or possession of valid username and password credentials for a TOTP-enabled account
- Trigger point: Basic authentication through the WebDAV endpoint
- Why exploitation is possible: The WebDAV authentication path validates primary credentials without requiring the configured second factor
- Attack surface: FileRise WebDAV service
- Required access: Knowledge or possession of valid username and password credentials for a TOTP-enabled account
- Trigger point: Basic authentication through the WebDAV endpoint
- Why exploitation is possible: The WebDAV authentication path validates primary credentials without requiring the configured second factor
Why this happens
The vulnerability results from inconsistent authentication enforcement across separate login paths. The WebDAV callback delegates authentication to logic that verifies the username and password but does not apply the account's TOTP requirement, allowing a single factor to substitute for multi-factor authentication. This maps to CWE-308: Use of Single-factor Authentication, because an intended second authentication factor is not enforced for a protected service.
The vulnerability results from inconsistent authentication enforcement across separate login paths. The WebDAV callback delegates authentication to logic that verifies the username and password but does not apply the account's TOTP requirement, allowing a single factor to substitute for multi-factor authentication. This maps to CWE-308: Use of Single-factor Authentication, because an intended second authentication factor is not enforced for a protected service.
Potential impact
- Unauthorized access to files and directories available through WebDAV
- File uploads, modifications, deletions, or batch operations within the account's permissions
- Exposure of sensitive stored data
- Possible persistence or further compromise through writable files
- Increased impact if the affected account has administrative or broad file permissions
- Unauthorized access to files and directories available through WebDAV
- File uploads, modifications, deletions, or batch operations within the account's permissions
- Exposure of sensitive stored data
- Possible persistence or further compromise through writable files
- Increased impact if the affected account has administrative or broad file permissions
General mitigation guidance
Mitigation generally focuses on enforcing the same authentication policy across every access path.
Common defensive patterns include:
- Require TOTP or an equivalent second factor before issuing WebDAV sessions or allowing WebDAV operations
- Centralize authentication and MFA decisions so alternate endpoints cannot omit required checks
- Apply secure-by-default settings that do not expose WebDAV unnecessarily
- Reduce account and WebDAV permissions according to least privilege
- Use separate, narrowly scoped service accounts where interactive administrator credentials are not required
- Monitor and restrict access to WebDAV endpoints through network and policy controls
Mitigation generally focuses on enforcing the same authentication policy across every access path.
Common defensive patterns include:
- Require TOTP or an equivalent second factor before issuing WebDAV sessions or allowing WebDAV operations
- Centralize authentication and MFA decisions so alternate endpoints cannot omit required checks
- Apply secure-by-default settings that do not expose WebDAV unnecessarily
- Reduce account and WebDAV permissions according to least privilege
- Use separate, narrowly scoped service accounts where interactive administrator credentials are not required
- Monitor and restrict access to WebDAV endpoints through network and policy controls
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis and code review checks for authentication callbacks that validate passwords without invoking MFA policy checks
- Comparisons of authentication behavior across browser, API, WebDAV, and other protocol-specific entry points
- Tests confirming that TOTP-enabled accounts cannot access protected services with only primary credentials
- Policy enforcement requiring centralized authentication middleware for all protected endpoints
- Log analysis for successful WebDAV authentication by TOTP-enabled accounts without corresponding second-factor events
- Automated security testing that exercises alternate authentication paths and authorization boundaries
Organizations can look for this class of issue through:
- Static analysis and code review checks for authentication callbacks that validate passwords without invoking MFA policy checks
- Comparisons of authentication behavior across browser, API, WebDAV, and other protocol-specific entry points
- Tests confirming that TOTP-enabled accounts cannot access protected services with only primary credentials
- Policy enforcement requiring centralized authentication middleware for all protected endpoints
- Log analysis for successful WebDAV authentication by TOTP-enabled accounts without corresponding second-factor events
- Automated security testing that exercises alternate authentication paths and authorization boundaries
