CVE-2022-36071: Recovery codes abuse in SFTPGo
First published: Fri Sep 02 2022(Updated: )
SFTPGo is configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support. SFTPGo WebAdmin and WebClient support login using TOTP (Time-based One Time Passwords) as a secondary authentication factor. Because TOTPs are often configured on mobile devices that can be lost, stolen or damaged, SFTPGo also supports recovery codes. These are a set of one time use codes that can be used instead of the TOTP. In SFTPGo versions from version 2.2.0 to 2.3.3 recovery codes can be generated before enabling two-factor authentication. An attacker who knows the user's password could potentially generate some recovery codes and then bypass two-factor authentication after it is enabled on the account at a later time. This issue has been fixed in version 2.3.4. Recovery codes can now only be generated after enabling two-factor authentication and are deleted after disabling it.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SFTPGo project SFTPGo | >=2.2.0<2.3.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-36071?
CVE-2022-36071 is considered a medium severity vulnerability due to its potential impact on user authentication integrity.
How do I fix CVE-2022-36071?
To fix CVE-2022-36071, ensure that you upgrade your SFTPGo installation to version 2.3.5 or later.
Who is affected by CVE-2022-36071?
Users of SFTPGo versions between 2.2.0 and 2.3.4 are impacted by CVE-2022-36071.
What is the nature of the vulnerability CVE-2022-36071?
CVE-2022-36071 addresses an issue with TOTP on mobile devices that can be lost or stolen, compromising secondary authentication.
Is there a public disclosure for CVE-2022-36071?
Yes, CVE-2022-36071 has been publicly disclosed and can be reviewed in detail on the appropriate security advisories and bug reports.
- agent/references
- agent/weakness
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/last-modified-date
- agent/remedy
- agent/title
- agent/event
- agent/first-publish-date
- agent/description
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/sftpgo project
- canonical/sftpgo project sftpgo
- version/sftpgo project sftpgo/2.2.0