GHSA-P6PH-3JX2-3337: Horizontal Privilege Escalation and Metadata Information Disclosure via Bleve Search in OpenList

OpenList is a Go-based self-hosted file list and storage service designed to organize and index user-uploaded assets. To provide fast lookup and retrieval capabilities, the system integrates the Bleve search engine backend, indexing metadata such as names, types, sizes, and parent directories of files.

The search component exposes an API endpoint (/api/fs/search) that receives query parameters from authenticated clients and scopes results according to defined user namespaces. Multi-tenant partitioning is enforced by validating that retrieved files reside within a designated directory subtree, referred to as the BasePath restriction.

However, logical flaws in path validation and result summary compilation allow clients to bypass these directory restrictions. By exploiting these weaknesses, low-privileged users can execute horizontal privilege escalation, mapping restricted directory trees and identifying sensitive files across directories they do not own or possess authorization to read.

The authorization bypass stems from an insecure path verification implementation inside the directory containment handler. To ensure a returned node belongs to the requesting client's tenant namespace, the server verifies if the file's parent directory starts with the user's restricted base path.

Prior to version 4.2.4, this validation check was performed in server/handles/search.go and server/handles/sharing.go using the Go standard library function strings.HasPrefix(node.Parent, user.BasePath). Because strings.HasPrefix behaves as a character-by-character string comparator, it is not path-separator aware. It fails to evaluate structural directory boundaries denoted by the / symbol.

If a victim directory is situated at /base2 and the attacker's restricted scope is /base, the evaluator processes strings.HasPrefix("/base2", "/base"). This returns true because /base2 starts with the literal string /base. The system mistakes the sibling folder /base2 for a child of /base, bypassing the containment logic.

A secondary flaw resides in how search result volumes are tracked and returned. When searching, the global Bleve engine queries matches and computes total hit counts. The system returns the un-cleansed global total value back to the user response payload, exposing a side-channel metadata leak. Even when subsequent ACL controls filter unauthorized file nodes from the response body, the global match count persists, confirming the existence of matching documents globally.

In the vulnerable version of the codebase, path validation checks were performed directly against raw strings without canonical path-boundary parsing. The server iterated through matching nodes and applied a naive prefix match.

// VULNERABLE LOGIC IN server/handles/search.go
for _, node := range nodes {
    if !strings.HasPrefix(node.Parent, user.BasePath) {
        continue
    }
    // ...
}

To resolve the directory containment failure, the remediation replaced strings.HasPrefix with a utility method utils.IsSubPath(). The IsSubPath function splits the directories into distinct segments based on the system delimiter, preventing sibling boundary traversal.

// PATCHED LOGIC IN server/handles/search.go
for _, node := range nodes {
    if !utils.IsSubPath(user.BasePath, node.Parent) {
        continue
    }
    // ...
}

To address the side-channel leakage, the second patch implemented the SearchFiltered function inside the Bleve search client. Instead of calculating the overall search count beforehand, the function processes nodes in chunks of 1000, calling the path separator and ACL filter function first, incrementing the total counter only for authorized records.

// PATCHED BATCH PROCESSING IN internal/search/bleve/search.go
for _, hit := range searchResults.Hits {
    node := searchNodeFromHit(hit)
    if !utils.IsSubPath(req.Parent, node.Parent) || filter != nil && !filter(node) {
        continue
    }
    if total >= from && total < to {
        result = append(result, node)
    }
    total++
}

To execute the sibling path traversal, an attacker must first authenticate and obtain a valid session token. The user then constructs a POST request targeting the search endpoint /api/fs/search seeking files in sibling directories.

POST /api/fs/search HTTP/1.1
Host: target-instance.local
Authorization: Bearer <session-token>
Content-Type: application/json
 
{
  "parent": "/",
  "keywords": "confidential",
  "page": 1,
  "per_page": 10,
  "scope": 0
}

If the system is vulnerable and contains a directory /base2 where the attacker is restricted to /base, files matching the keyword within /base2 will bypass prefix validation. The server returns the structural metadata including file paths and sizes in the JSON response payload.

If strict folder-level access passwords block the returned array from displaying the node parameters, the attacker relies on the side-channel count. By checking if the returned total count is greater than zero, the user confirms the presence and quantitative volume of matching records, permitting systematic brute-force keyword verification across the entire server archive.

The overall impact of this vulnerability is a partial compromise of confidentiality. Attackers who possess low-privileged access to the application can map out directory structures, identify files, and gather quantitative data across administrative or private namespaces.

The inability of the server to cleanly segregate user namespaces breaks multi-tenant configurations. Sibling organizations hosted on the same server can discover information about each other's storage directories.

This vulnerability does not directly impact the integrity or availability of files on the system, as the bypass does not grant unauthorized write, delete, or modify actions. However, the data gathered via directory structure mapping can be chained with other exploits to target specific assets.

Organizations running OpenList should immediately upgrade instances to version 4.2.4 or higher. This release integrates structural path boundary evaluations using utils.IsSubPath and restricts Bleve statistical counts, addressing both vector points.

If immediate software upgrade is unfeasible, administrators can mitigate the issue by disabling global search indexing. Disabling the Bleve search mode shuts down the vulnerable endpoint, preventing exploitation.

Additionally, administrators can implement a defensive naming convention for tenant directories. Ensuring that user base paths do not share overlapping prefix character sequences (e.g., separating /user-data/ from /user-archive/ by using random strings or distinct subdirectories) blocks character-based prefix match bypasses.