Vulnerability · Published Nov 29, 2024 · Assigned by GitHub_M

CVE-2024-52801Brute force takeover of OpenID Connect session cookies in sftpgo

Medium 5.3

In plain English

A medium-severity broken cryptography in sftpgo from drakkan. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.4%top 65.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

sftpgo is a full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, FTP/S, WebDAV. The OpenID Connect implementation allows authenticated users to brute force session cookies and thereby gain access to other users' data, since the cookies are generated predictably using the xid library and are therefore unique but not cryptographically secure. This issue was fixed in version v2.6.4, where cookies are opaque and cryptographically secure strings. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/drakkan/sftpgo	no fix listed	GO-2024-3300
Go	github.com/drakkan/sftpgo/v2	2.6.4	GHSA-6943-qr24-82vx
Go	github.com/drakkan/sftpgo/v2	2.6.4	GO-2024-3300

Affected products (as reported)

Vendor	Product	Versions
drakkan	sftpgo	>= 2.3.0, < 2.6.4

Weakness: CWE-327 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/drakkan/sftpgo/security/advisories/GHSA-6943-qr24-82vx x_refsource_CONFIRM
https://github.com/drakkan/sftpgo/commit/f30a9a2095bf90c0661b04fe038e3b7efc788bc6 x_refsource_MISC
https://github.com/rs/xid x_refsource_MISC