CVE-2024-52309

SFTPGo allows administrators to restrict command execution from the EventManager

Severity Score

5.1

*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

MITRE

SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob. One powerful feature of SFTPGo is the ability to have the EventManager execute scripts or run applications in response to certain events. This feature is very common in all software similar to SFTPGo and is generally unrestricted. However, any SFTPGo administrator with permission to run a script has access to the underlying OS/container with the same permissions as the user running SFTPGo. This is unexpected for some SFTPGo administrators who think that there is a clear distinction between accessing the system shell and accessing the SFTPGo WebAdmin UI. To avoid this confusion, running system commands is disabled by default in 2.6.3, and an allow list has been added so that system administrators configuring SFTPGo must explicitly define which commands are allowed to be configured from the WebAdmin UI.

*Credits: N/A

CVSS Scores

GitHubv4 5.1

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

High

User Interaction

None

System

Vulnerable | Subsequent

Confidentiality

None

Low

Integrity

None

Low

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2024-11-06 CVE Reserved
2024-11-21 CVE Published
2024-11-21 CVE Updated
---------- EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-20: Improper Input Validation

CAPEC

References (3)

URL	Tag	Source
https://github.com/drakkan/sftpgo/security/advisories/GHSA-49cc-xrjf-9qf7	X_refsource_confirm
https://github.com/drakkan/sftpgo/commit/88b1850b5806eee81150873d4e565144b21021fb	X_refsource_misc
https://github.com/drakkan/sftpgo/commit/b524da11e9466d05fe03304713ee1c61bb276ec4	X_refsource_misc

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Drakkan Search vendor "Drakkan"		Sftpgo Search vendor "Drakkan" for product "Sftpgo"				>= 2.4.0 < 2.6.3 Search vendor "Drakkan" for product "Sftpgo" and version " >= 2.4.0 < 2.6.3"		en		Affected