Foxel through 2.4.0 Unauthenticated File Read via /api/fs/stream and /api/fs/thumb

Summary

Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /api/fs/stream and /api/fs/thumb endpoints. Attackers can supply a VFS mount prefix and relative path to retrieve full file contents or thumbnails across all mounts, bypassing PathRule permission grants.

Remediation

1. Inventory every DrizzleTime Foxel deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Patchhttps://github.com/DrizzleTime/Foxel/commit/73d9fa825e1004d37abb7b10faea0cd7f5bcb463
• Advisoryhttps://www.vulncheck.com/advisories/foxel-through-2.4.0-unauthenticated-file-read-via-api-fs-stream-and-api-fs-thumb
• Referencehttps://github.com/DrizzleTime/Foxel/issues/152
• Referencehttps://github.com/DrizzleTime/Foxel
• Referencehttps://github.com/DrizzleTime/Foxel/blob/v2.4.0/domain/virtual_fs/api.py#L164-L182
• Referencehttps://github.com/DrizzleTime/Foxel/blob/v2.4.0/api/routers.py#L31