PT-2024-29333 · Filestash · Filestash

Published 2024-07-31 · Updated 2024-08-06 · CVE-2024-41255

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions filestash version 0.4

Description The issue is related to filestash being configured to skip TLS certificate verification when using the FTPS protocol. This could potentially allow attackers to execute a man-in-the-middle attack via the Init function of index.go.

Recommendations For filestash version 0.4, consider disabling the FTPS protocol until a patch is available that enables TLS certificate verification. Restrict access to the Init function of index.go to minimize the risk of exploitation. Avoid using the FTPS protocol in filestash until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-453

CWE-295

Related Identifiers

CVE-2024-41255

GHSA-4JMM-C6JW-G796

GO-2024-3033

Affected Products

Filestash

References · 12

• https://osv.dev/vulnerability/GO-2024-3033 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41255 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41255 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4jmm-c6jw-g796 · Vendor Advisory
• https://github.com/mickael-kerjean/filestash · Note
• https://github.com/mickael-kerjean/filestash/blob/master/server/plugin/plg_backend_ftp/index.go#L108 · Note
• https://github.com/mickael-kerjean/filestash/issues/710 · Note
• https://pkg.go.dev/vuln/GO-2024-3033 · Note
• https://t.me/cvedetector/2176 · Telegram Post
• https://gist.github.com/nyxfqq/c367f2ca9448810924dcf0f1af30b441 · Note
• https://github.com/advisories/GHSA-4jmm-c6jw-g796 · Note
• https://t.me/cvenotify/88250 · Telegram Post