BIGNIGHT: R-513 filed (P1 security: FileBrowser admin/admin on every box; demo-hp login page public)

2026-09-14 20:32:03 +02:00
parent 8a12c9a1bc
commit 5e8bff6808
9 changed files with 94 additions and 0 deletions
@@ -332,3 +332,11 @@ originals**. Attachment: the v2 slot's returned `url` is `/ciphers/<id>/attachme
 The retried attachment downloads 200 with its recorded size; byte-equality not proven (harness lost the key).
 **Finding R-512 (P2):** registration stays open and the page's instruction to close it points at a read-only
 field; a stranger registered with no invite (200).
+
+### SECURITY — R-513 (P1), found 18:30Z while looking for a way to put a video on the drive
+
+The launcher's **Filebrowser** tile opens `files.enkicsifelhom.hu`: password login, no signup. **No screen gives the
+customer a FileBrowser login.** A customer's first guess, `admin` / `admin`, **works** (200 + token); wrong password
+401. With it, both sources list (Adatlemez → `documents`, …; Beolvasás → `paperless`). The same login works on demo-hp's
+**9201** and **9202**, and 9201's login page answers **200 through Cloudflare from the internet** (GET only, no login
+attempted remotely). Filed R-513 before anything else; nothing changed on any box.
@@ -0,0 +1,10 @@
+  select HDD_PATH: options=['Adatlemez — 92.0 GB szabad (alapértelmezett)'] -> /mnt/felhom-drives/hdd_1
+jellyfin: fields ['HDD_PATH', 'SUBDOMAIN']; secrets in /tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/a23ddbf6-6c9b-4b80-8fa9-69a2a962eeb6/scratchpad/apps/jellyfin.json: []
+POST 18:29:34
+  -> {"ok":true,"message":"Telepítés elindítva – az állapot a kártyán követhető"}
+
+  +5s not_deployed
+  +10s deploying
+  +40s starting
+  +50s running
+jellyfin: final running after 50s
@@ -7,3 +7,5 @@ POST 18:26:12
  +5s not_deployed
  +10s deploying
  +81s starting
+  +182s running
+paperless-ngx: final running after 182s
@@ -0,0 +1,10 @@
+18:30:10 launcher tile -> files.enkicsifelhom.hu; login page: passwordAvailable True, signup False, noAuth False
+try admin/admin (what a customer would guess) -> 200 <JWT redacted>
+18:30:38 negative control admin/<wrong> -> 401 {"status":401,"message":"user unauthorized"}
+admin/admin -> 200
+self 401 {'username': None, 'perm': None, 'permissions': None, 'scopes': None}
+list Adatlemez 401 [] []
+list Beolvasás 401 [] []
+VM333 auth via bearer users/self 200 {"editorQuickSave":false,"hideSidebarFileActions":false,"disableQuickToggles":false,"disableSearchOptions":false,"deleteWithoutConfirming":false,"preview":{"dis
+  list Adatlemez 200 {"name":"hdd_1","size":45056,"modified":"2026-09-14T20:12:59.031117756+02:00","type":"directory","hidden":false,"hasPreview":false,"folders":[{"name":"documents","size":4096,"modified":"2026-09-14T20:12:59.028945995+02:0
+  list Beolvasás 200 {"name":"beolvasas","size":4096,"modified":"2026-09-14T20:26:13.419412334+02:00","type":"directory","hidden":false,"hasPreview":false,"folders":[{"name":"paperless","size":4096,"modified":"2026-09-14T20:28:54.364385439+0
@@ -0,0 +1,7 @@
+=== public reachability of demo-hp's Filebrowser login page, GET only, from DooPlex via Cloudflare 2026-09-14T18:31:13Z
+172.67.130.252 104.21.3.175 
+GET https://files.enkisfelhom.hu/ -> 200 server=cloudflare
+"noAuth":false
+"passwordAvailable":true
+FileBrowser Quantum
+(no login was attempted over the internet)
@@ -7,3 +7,11 @@
 18:26:39 jobs pending {'faceDetection': (2, 194), 'smartSearch': (2, 181), 'ocr': (1, 197)}
 18:27:09 jobs pending {'faceDetection': (2, 188), 'smartSearch': (2, 163), 'ocr': (1, 193)}
 18:27:39 jobs pending {'faceDetection': (2, 182), 'smartSearch': (2, 144), 'ocr': (1, 189)}
+18:28:09 jobs pending {'faceDetection': (2, 168), 'smartSearch': (2, 115), 'ocr': (1, 183)}
+18:28:39 jobs pending {'faceDetection': (2, 147), 'smartSearch': (2, 74), 'ocr': (1, 173)}
+18:29:09 jobs pending {'faceDetection': (2, 118), 'smartSearch': (2, 21), 'ocr': (1, 162)}
+18:29:39 jobs pending {'faceDetection': (2, 68), 'ocr': (1, 140)}
+18:30:09 jobs pending {'faceDetection': (2, 40), 'ocr': (1, 129)}
+18:30:39 jobs pending {'faceDetection': (2, 16), 'ocr': (1, 118)}
+18:31:09 jobs pending {'ocr': (1, 94)}
+18:31:39 jobs pending {'ocr': (1, 57)}
@@ -0,0 +1,13 @@
+18:31:37 public info 200 {"LocalAddress":"http://172.18.0.14:8096","ServerName":"bdfc2285e7e5","Version":"10.11.11","ProductName":"Jellyfin Server","OperatingSystem":"","Id":"343cb9311f
+18:31:37 wizard /Startup/Configuration 204
+18:31:38 wizard /Startup/User 200
+18:31:38 wizard /Startup/User 204
+18:31:38 wizard /Startup/RemoteAccess 204
+18:31:38 wizard /Startup/Complete 204
+18:31:40 login 200
+18:31:40 libraries before 200 []
+18:31:40 dir browser 200 {}
+18:31:40 drives 200 ['/', '/cache', '/config', '/media']
+18:31:40 dir /media 200 ['/media/audiobooks', '/media/books', '/media/comics', '/media/movies', '/media/music', '/media/photos', '/media/podcasts', '/media/tv']
+18:31:40 dir /data 404 
+18:31:40 dir /mnt 200 []
@@ -0,0 +1,35 @@
+18:29:52 token (generated admin) 200
+18:29:52 tag Számla 201
+18:29:52 tag Garancia 201
+18:29:52 tag Adó 201
+18:29:57 posted 20 documents
+18:29:57 tasks {'PENDING': 18, 'STARTED': 2}
+18:30:07 tasks {'PENDING': 18, 'STARTED': 2}
+18:30:17 tasks {'PENDING': 14, 'STARTED': 2, 'FAILURE': 4}
+18:30:28 tasks {'PENDING': 14, 'STARTED': 2, 'FAILURE': 4}
+18:30:38 tasks {'PENDING': 12, 'STARTED': 2, 'FAILURE': 6}
+18:30:48 tasks {'PENDING': 12, 'STARTED': 2, 'FAILURE': 6}
+18:30:58 tasks {'PENDING': 10, 'STARTED': 2, 'FAILURE': 8}
+Traceback (most recent call last):
+  File "/usr/lib/python3/dist-packages/requests/models.py", line 963, in json
+    return complexjson.loads(self.content.decode(encoding), **kwargs)
+           ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+  File "/usr/lib/python3.13/json/__init__.py", line 346, in loads
+    return _default_decoder.decode(s)
+           ~~~~~~~~~~~~~~~~~~~~~~~^^^
+  File "/usr/lib/python3.13/json/decoder.py", line 345, in decode
+    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
+               ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^
+  File "/usr/lib/python3.13/json/decoder.py", line 363, in raw_decode
+    raise JSONDecodeError("Expecting value", s, err.value) from None
+json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
+
+During handling of the above exception, another exception occurred:
+
+Traceback (most recent call last):
+  File "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/a23ddbf6-6c9b-4b80-8fa9-69a2a962eeb6/scratchpad/seed_paperless.py", line 21, in <module>
+    r=s.get(B+'/api/tasks/',headers=H); st=[t.get('status') for t in r.json() if t.get('task_id') in tasks]
+                                                                     ~~~~~~^^
+  File "/usr/lib/python3/dist-packages/requests/models.py", line 971, in json
+    raise RequestsJSONDecodeError(e.msg, e.doc, e.pos)
+requests.exceptions.JSONDecodeError: Expecting value: line 1 column 1 (char 0)