PT-2024-35169 · Sftpgo · Sftpgo

Hyperreality · Published 2024-11-21 · Updated 2024-11-23 · CVE-2024-52309

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions SFTPGo versions prior to 2.6.3

Description SFTPGo has a feature that allows the EventManager to execute scripts or run applications in response to certain events. However, any SFTPGo administrator with permission to run a script has access to the underlying OS/container with the same permissions as the user running SFTPGo. This is unexpected for some SFTPGo administrators who think that there is a clear distinction between accessing the system shell and accessing the SFTPGo WebAdmin UI. The issue allows potential remote code execution.

Recommendations For versions prior to 2.6.3, consider upgrading to version 2.6.3 or later, where running system commands is disabled by default and an allow list has been added to define which commands are allowed to be configured from the WebAdmin UI. As a temporary workaround, restrict the EventManager to be used only by SFTPGo administrators who also have shell access.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-52309

GHSA-49CC-XRJF-9QF7

GO-2024-3283

OPENSUSE-SU-2024:14519-1

Affected Products

Sftpgo

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52309.json · Exploit
• https://osv.dev/vulnerability/GHSA-49cc-xrjf-9qf7 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14519-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-52309 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3283 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52309 · Security Note
• https://github.com/drakkan/sftpgo · Note
• https://github.com/drakkan/sftpgo/commit/b524da11e9466d05fe03304713ee1c61bb276ec4 · Note
• https://github.com/drakkan/sftpgo/security/advisories/GHSA-49cc-xrjf-9qf7 · Note
• https://github.com/drakkan/sftpgo/commit/88b1850b5806eee81150873d4e565144b21021fb · Note
• https://twitter.com/oktsec/status/1859682757963571248 · Twitter Post
• https://lists.opensuse.org/archives/list/[e-mail]/thread/FNC2B63TAEEYGQ7XDBRHH6KDG7VDWO65 · Note
• https://suse.com/security/cve/CVE-2024-52282 · Note
• https://pkg.go.dev/vuln/GO-2024-3283 · Note
• https://suse.com/security/cve/CVE-2024-52309 · Note