PT-2024-35452 · Sftpgo+1 · Sftpgo+1

Denisvr72 · Published 2024-11-29 · Updated 2024-12-11 · CVE-2024-52801

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions sftpgo versions prior to v2.6.4

Description The OpenID Connect implementation in sftpgo allows authenticated users to brute force session cookies, gaining access to other users' data. This is because the cookies are generated predictably using the xid library and are unique but not cryptographically secure.

Recommendations For versions prior to v2.6.4, upgrade to version v2.6.4 or later, where cookies are opaque and cryptographically secure strings. As a temporary workaround, consider restricting access to the OpenID Connect implementation until a patch is available. Avoid using the predictably generated session cookies in the affected API endpoints until the issue is resolved.

Exploit

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2024-52801

GHSA-6943-QR24-82VX

GO-2024-3300

OPENSUSE-SU-2024:14567-1

Affected Products

Sftpgo

Xid

References · 34

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52801.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-52801 · Security Note
• https://osv.dev/vulnerability/GHSA-6943-qr24-82vx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-52801 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3300 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14567-1 · Vendor Advisory
• https://github.com/drakkan/sftpgo · Note
• https://github.com/drakkan/sftpgo/security/advisories/GHSA-6943-qr24-82vx · Note
• https://github.com/drakkan/sftpgo/commit/f30a9a2095bf90c0661b04fe038e3b7efc788bc6 · Note
• https://github.com/rs/xid · Note
• https://suse.com/security/cve/CVE-2024-53264 · Note
• https://suse.com/security/cve/CVE-2024-53858 · Note
• https://suse.com/security/cve/CVE-2024-54132 · Note
• https://suse.com/security/cve/CVE-2024-50948 · Note
• https://suse.com/security/cve/CVE-2024-52529 · Note