PT-2024-4465 · Sftpgo · Sftpgo

T7Tran · Published 2024-06-07 · Updated 2024-06-28 · CVE-2024-37897

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SFTPGo versions prior to v2.6.1

Description The issue is related to insufficient access control for password reset in SFTPGo, allowing users with access restrictions to reset their password and log in, even if their access has expired. This can be exploited by a remote attacker to bypass existing security restrictions. The password reset feature is disabled by default, but if enabled, it poses a risk.

Recommendations For SFTPGo versions prior to v2.6.1, upgrade to version 2.6.1. As a temporary workaround, consider keeping the password reset feature disabled. Alternatively, set a blank email address for users and admins with access restrictions so they cannot receive the email with the reset code and exploit the vulnerability.

Exploit

Fix

Incorrect Authorization

Improper Authentication

Weakness Enumeration

CWE-863

CWE-287

Related Identifiers

BDU:2024-04967

CVE-2024-37897

GHSA-HW5F-6WVV-XCRH

GO-2024-2940

Affected Products

Sftpgo

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37897.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-37897 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37897 · Security Note
• https://bdu.fstec.ru/vul/2024-04967 · Security Note
• https://osv.dev/vulnerability/GHSA-hw5f-6wvv-xcrh · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2940 · Vendor Advisory
• https://github.com/drakkan/sftpgo · Note
• https://github.com/drakkan/sftpgo/commit/1f8ac8bfe16100b0484d6c91e1e8361687324423 · Note
• https://github.com/drakkan/sftpgo/security/advisories/GHSA-hw5f-6wvv-xcrh · Note
• https://github.com/drakkan/sftpgo/commit/3462bba3f41cbc75486474991b9e3ac1b5f1e583 · Note
• https://github.com/drakkan/sftpgo/releases/tag/v2.6.1 · Note
• https://twitter.com/linuxpatch/status/1803867976329728116 · Twitter Post
• https://twitter.com/CVEnew/status/1803848089888780536 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1803966429458317807 · Twitter Post
• https://sftpgo.github.io/latest · Note