PT-2024-29334 · Filestash · Filestash

Bingyu Li · Published 2024-07-31 · Updated 2025-03-18 · CVE-2024-41256

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions filestash version 0.4

Description The issue is related to the ShareProofVerifier function in filestash, which skips the TLS certificate verification process when sending out email verification codes. This could allow attackers to access sensitive data via a man-in-the-middle attack.

Recommendations For filestash version 0.4, consider disabling the ShareProofVerifier function until a patch is available to enforce TLS certificate verification. Restrict access to sensitive data to minimize the risk of exploitation.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2024-41256

GHSA-MPVX-WHPP-99XJ

GO-2024-3035

Affected Products

Filestash

References · 13

• https://osv.dev/vulnerability/CVE-2024-41256 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41256 · Security Note
• https://osv.dev/vulnerability/GO-2024-3035 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mpvx-whpp-99xj · Vendor Advisory
• https://github.com/mickael-kerjean/filestash · Note
• https://github.com/mickael-kerjean/filestash/blob/master/server/model/share.go#L132 · Note
• https://github.com/mickael-kerjean/filestash/issues/709 · Note
• https://t.me/cvedetector/2175 · Telegram Post
• https://t.me/cvenotify/90747 · Telegram Post
• https://pkg.go.dev/vuln/GO-2024-3035 · Note
• https://gist.github.com/nyxfqq/a6da3fe6128b978ea1aaa5df639d5f98 · Note
• https://github.com/advisories/GHSA-mpvx-whpp-99xj · Note
• https://t.me/cvenotify/115217 · Telegram Post