GHSA-6943-qr24-82vx

Source

https://github.com/advisories/GHSA-6943-qr24-82vx

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/12/GHSA-6943-qr24-82vx/GHSA-6943-qr24-82vx.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-6943-qr24-82vx

Aliases

CVE-2024-52801
GO-2024-3300

Published

2024-12-02T17:16:34Z

Modified

2024-12-02T22:05:00Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

sftpgo vulnerable to brute force takeover of OpenID Connect session cookies

Details

Impact

The OpenID Connect implementation, in the affected SFTPGo versions, allows authenticated users to brute force session cookies and thereby gain access to other users' data, since the cookies are generated predictably using the xid library and are therefore unique but not cryptographically secure.

Patches

This issue was fixed in version v2.6.4, where cookies are opaque and cryptographically secure strings.

References

https://github.com/drakkan/sftpgo/commit/f30a9a2095bf90c0661b04fe038e3b7efc788bc6

Database specific

{
    "nvd_published_at": "2024-11-29T19:15:08Z",
    "cwe_ids": [
        "CWE-327"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-12-02T17:16:34Z"
}

References

Affected packages

Go / github.com/drakkan/sftpgo/v2

Package

Name: github.com/drakkan/sftpgo/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/drakkan/sftpgo/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.3.0

Fixed

2.6.4