A critical race condition vulnerability in vastsa FileCodeBox allows unauthenticated attackers to bypass download count restrictions, potentially leading to unauthorized data exfiltration.

The vulnerability is a Time-of-Check to Time-of-Use (TOCTOU) race condition within the update_file_usage function in apps/base/views.py. An unauthenticated attacker can exploit this via concurrent requests to bypass configured download limits, effectively allowing unlimited access to shared files.

The ability to bypass download limits undermines the core access control policies of the file-sharing platform. This may lead to the unauthorized distribution of sensitive documents, depletion of bandwidth, and potential exposure of proprietary information. Given the CVSS score of 7.3, this flaw presents a significant risk to data confidentiality and integrity, particularly for organizations relying on FileCodeBox to distribute controlled assets.

Immediate Action: Upgrade to version 2.5.0 or later immediately to apply the necessary patches for the race condition and associated logic flaws.

Proactive Monitoring: Monitor server access logs for anomalous patterns of repeated requests for the same file code or high-frequency requests from single IP addresses that indicate automated enumeration or exploitation attempts.

Compensating Controls: Implement rate limiting at the Web Application Firewall (WAF) or reverse proxy level to detect and block abnormal request volumes targeting the /share/select/ and /share/metadata/ endpoints.

Public Exploit Available: Yes — a technical write-up detailing the exploitation mechanism and providing reproduction steps is available via the GitHub issue tracker referenced in the CVE record.

The presence of a public proof-of-concept and the ease of exploitation necessitate immediate action. Administrators must prioritize updating to version 2.5.0 to remediate the race condition and associated logic flaws. Failure to patch leaves the system vulnerable to unauthorized data access and potential mass exfiltration of shared content.