CVE-2024-52801 - Brute force takeover of OpenID Connect session cookies in sftpgo

Back Back to CVE browser

MEDIUM

Brute force takeover of OpenID Connect session cookies in sftpgo

Published Nov 29, 2024

5.3

MEDIUM

CVSS 4.0

EPSS 0.40%

Description

sftpgo is a full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, FTP/S, WebDAV. The OpenID Connect implementation allows authenticated users to brute force session cookies and thereby gain access to other users' data, since the cookies are generated predictably using the xid library and are therefore unique but not cryptographically secure. This issue was fixed in version v2.6.4, where cookies are opaque and cryptographically secure strings. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

Vendor Drakkan Product Sftpgo Default
n/a
- Version
  >= 2.3.0, < 2.6.4
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Drakkan

Sftpgo

n/a

Version	Status	Constraints
>= 2.3.0, < 2.6.4	affected	-

github.com/drakkan/sftpgo/v2

Go

Introduced 2.3.0 Fixed 2.6.4
github.com/drakkan/sftpgo

Go

Introduced 0 Fixed not fixed

Ecosystem	Package	Introduced	Fixed
Go	github.com/drakkan/sftpgo/v2	2.3.0	2.6.4
Go	github.com/drakkan/sftpgo	0	not fixed

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-327

Broken Crypto Algorithm

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-3435
Advisory
https://github.com/advisories/GHSA-6943-qr24-82vx
Advisory
https://github.com/drakkan/sftpgo/commit/f30a9a2095bf90c0661b04fe038e3b7efc788bc6
x_refsource_MISC
https://github.com/drakkan/sftpgo/security/advisories/GHSA-6943-qr24-82vx
x_refsource_CONFIRM
https://github.com/rs/xid
x_refsource_MISC
https://nvd.nist.gov/vuln/detail/CVE-2024-52801

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-3435		Advisory
https://github.com/advisories/GHSA-6943-qr24-82vx		Advisory
https://github.com/drakkan/sftpgo/commit/f30a9a2095bf90c0661b04fe038e3b7efc788bc6		x_refsource_MISC
https://github.com/drakkan/sftpgo/security/advisories/GHSA-6943-qr24-82vx		x_refsource_CONFIRM
https://github.com/rs/xid		x_refsource_MISC
https://nvd.nist.gov/vuln/detail/CVE-2024-52801