References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Change History

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticated requester who can reach a public share can select a canonical path outside the shared directory when the target path begins with the shared directory's name, such as a sibling path that shares the same prefix. The endpoint then includes the out-of-scope file in the generated download, disclosing its contents. This issue is fixed in version 2.7.3.

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-22

https://github.com/drakkan/sftpgo/commit/52a56584c417e325aea35ab23849422a90ba512f

https://github.com/drakkan/sftpgo/releases/tag/v2.7.3

https://github.com/drakkan/sftpgo/security/advisories/GHSA-h64p-8h4r-6gfh

[{"vendor":"drakkan","product":"sftpgo","versions":[{"version":">= 2.2.0 < 2.7.2","status":"affected"}]}]