CVE-2024-52801
Description
sftpgo is a full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, FTP/S, WebDAV. The OpenID Connect implementation allows authenticated users to brute force session cookies and thereby gain access to other users' data, since the cookies are generated predictably using the xid library and are therefore unique but not cryptographically secure. This issue was fixed in version v2.6.4, where cookies are opaque and cryptographically secure strings. All users are advised to upgrade. There are no known workarounds for this vulnerability.
How to fix
- github.com/drakkan/sftpgo/v22.6.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/drakkan/sftpgo/v2Go | 2.3.0 ≤ v < 2.6.4 | 2.6.4 |
| github.com/drakkan/sftpgoGo | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.