Seafile is a widely deployed enterprise-grade self-hosted file synchronization and sharing platform, positioned as an alternative to Nextcloud with a focus on performance and team collaboration. Its security assessment covers several areas: the initial admin account for Seafile's seahub web interface is configured during setup with a username and password — weak passwords set for convenience during installation are commonly unchanged; Seafile's WebDAV interface (/seafdav) accepts user credentials and provides direct PROPFIND/GET/PUT access to all library files — this gives a more direct file access path than the web UI and can be used for bulk file extraction; Seafile's REST API at /api2/ issues authentication tokens via the /api2/auth-token/ endpoint — these tokens give programmatic access to all libraries the authenticated user can access with the ability to list, download, and upload files; Seafile's file sharing creates download links at /f/{token}/ and upload links at /u/{token}/ — download links without password protection are accessible to anyone with the URL and do not expire by default; and the Seafile admin panel exposes operations to view all users, libraries, and system statistics — admin credentials represent a full data access path across all organizational files. This guide covers systematic Seafile security assessment.
# Seafile REST API — token obtained from auth-token endpoint
SEAFILE_URL="https://files.example.com"
# Obtain API token with credentials (test common weak passwords)
for CREDS in "admin@example.com:admin123" "admin@seafile.com:seafile" \
"admin@example.com:password" "user@example.com:password"; do
EMAIL="${CREDS%%:*}"
PASS="${CREDS##*:}"
RESPONSE=$(curl -s -X POST "${SEAFILE_URL}/api2/auth-token/" \
-d "username=${EMAIL}&password=${PASS}" 2>/dev/null)
TOKEN=$(echo "$RESPONSE" | python3 -c "
import json,sys
d=json.load(sys.stdin)
print(d.get('token',''))
" 2>/dev/null)
if [ -n "$TOKEN" ]; then
echo "API TOKEN OBTAINED for ${EMAIL}: ${TOKEN}"
# List libraries accessible with this token
curl -s "${SEAFILE_URL}/api2/repos/" \
-H "Authorization: Token ${TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
if isinstance(d,list):
print(f'Libraries: {len(d)}')
for r in d[:5]:
print(f\" {r.get('name','?')} type={r.get('type','?')} size={r.get('size',0)//1024//1024}MB\")
" 2>/dev/null
break
fi
done# Seafile WebDAV interface at /seafdav
# Provides direct file access authenticated with username:password
SEAFILE_URL="https://files.example.com"
USERNAME="user@example.com"
PASSWORD="weak_password"
# PROPFIND to list library root via WebDAV
curl -s -X PROPFIND \
"${SEAFILE_URL}/seafdav/" \
-u "${USERNAME}:${PASSWORD}" \
-H "Depth: 1" \
-H "Content-Type: application/xml" \
-d '[^<]+ ' | \
sed 's/<[^>]*>//g' | head -10
# Bulk file download via WebDAV GET
# WebDAV GET on a library/path downloads the file directly
curl -s "${SEAFILE_URL}/seafdav/My%20Library/sensitive-file.pdf" \
-u "${USERNAME}:${PASSWORD}" \
-o /tmp/downloaded-seafile-file.pdf 2>/dev/null
echo "Downloaded file size: $(wc -c < /tmp/downloaded-seafile-file.pdf 2>/dev/null) bytes"| Security Test | Method | Risk |
|---|---|---|
| Weak admin credentials on API auth endpoint | POST /api2/auth-token/ with common passwords — API token grants full library read/write access for that user | Critical |
| WebDAV bulk file access with valid credentials | PROPFIND /seafdav/ then GET /seafdav/{library}/{file} — direct file access bypassing normal Seafile sharing controls | High |
| File download links without password or expiration | GET /f/{token}/ — any person with the share URL downloads the file; no authentication required by default | High |
| Admin API user and library enumeration | GET /api/v2.1/admin/users/ with admin token — lists all users and their library details across entire Seafile instance | High |
| Library sharing with overly permissive group access | Libraries shared with all users group expose content to every registered user on the instance | High |
| API token session hijacking from traffic interception | API token transmitted in Authorization header — interception on non-TLS or weak TLS connections yields persistent token | High |
Ironimo tests Seafile deployments for weak credentials on the API token authentication endpoint, WebDAV interface at /seafdav allowing bulk file enumeration and download with username/password authentication, file share links without password protection or expiration allowing anyone with the URL to download shared files, admin API user and library enumeration across all organizational file repositories, library sharing with all-users group exposing content to every registered account, and seahub session security via the SECRET_KEY configuration.
Start free scan