Filestash 0.4.0 exposes its admin configuration API during first-run setup while auth.admin is unset. A remote attacker who reaches the instance before setup completes can set the administrator password hash and take over the admin plane.
The AdminOnly middleware only enforces the admin cookie check when auth.admin is non-empty. During initial setup, auth.admin is empty, so /admin/api/config proceeds without an admin session.
GET /admin/api/session also reports an authenticated state in that setup condition. The configuration update handler accepts JSON, overwrites config.json, and reloads configuration immediately.
The attacker-controlled input is the submitted config JSON, specifically the auth.admin password hash. The missing boundary is external access control around first-run setup before the application has an administrator credential to enforce.
- Start a fresh Filestash 0.4.0 instance where
auth.adminis unset and the web interface is reachable. - Send
GET /admin/api/configwithout an admin cookie and retrieve the current configuration JSON. - Replace only the
auth.adminvalue with a bcrypt hash of an attacker-chosen password. - Send
POST /admin/api/configwith the modified JSON body. - Send
POST /admin/api/sessionwith the attacker's cleartext password and observe a valid admin session.
The observed result is unauthenticated administrative takeover of a reachable uninitialized Filestash instance. The attacker gains control over global configuration, storage definitions, sharing behavior, and secrets managed through the admin console.