Technical impact
A flaw in the WebDAV COPY operation in sigoden dufs allows an attacker to bypass proper authorization checks, enabling the creation or duplication of files without valid credentials. The vulnerability is triggered by manipulating the COPY request handling logic in src/server.rs. If exploited, an attacker could place malicious files or overwrite existing ones on the server, potentially leading to unauthorized data disclosure, modification, or even code execution if the uploaded content is executed downstream. The description categorizes this as an improper authorization weakness (CWE-285) and a missing authorization pattern (CWE-863).
Affected Systems
The issue affects all installations of sigoden dufs up to and including version 0.46.0. The affected component is the WebDAV copy operation handler located in server.rs. The recommended fix is to upgrade to version 0.47.0, which contains the patch commit fba13dffb9c65b5e5e26419f64de709200277a04.
Risk and Exploitability
The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, so the current probability of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. The attack can be carried out remotely against exposed WebDAV endpoints, and the exploit requires only sending a crafted COPY request; no local privileges or additional software are needed. Based on the description, it is inferred that the server’s authorization bypass is triggered when the request is processed, allowing an unauthenticated or improperly authenticated user to succeed in the COPY operation.
