CVE-2022-36071
Description
SFTPGo is configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support. SFTPGo WebAdmin and WebClient support login using TOTP (Time-based One Time Passwords) as a secondary authentication factor. Because TOTPs are often configured on mobile devices that can be lost, stolen or damaged, SFTPGo also supports recovery codes. These are a set of one time use codes that can be used instead of the TOTP. In SFTPGo versions from version 2.2.0 to 2.3.3 recovery codes can be generated before enabling two-factor authentication. An attacker who knows the user's password could potentially generate some recovery codes and then bypass two-factor authentication after it is enabled on the account at a later time. This issue has been fixed in version 2.3.4. Recovery codes can now only be generated after enabling two-factor authentication and are deleted after disabling it.
How to fix
- sftpgo_project sftpgo2.3.4 or later
- github.com/drakkan/sftpgo/v22.3.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sftpgo_project sftpgo | 2.2.0 ≤ v < 2.3.4 | 2.3.4 |
| github.com/drakkan/sftpgo/v2Go | 2.2.0 ≤ v < 2.3.4 | 2.3.4 |
| github.com/drakkan/sftpgoGo | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.