CVE-2024-40430: Medium severity sftpgo vulnerability
In SFTPGO 2.6.2, the JWT implementation lacks certain security measures, such as using JWT ID (JTI) claims, nonces, and proper expiration and invalidation mechanisms. NOTE: The vendor argues that the prerequisite for this exploit is to be able to steal another user's cookie. Additionally, it is argued that SFTPGo validates cookies being used by the IP address it was issued to, so stolen cookies from different IP addresses will not work.
Other sources
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
— NVD
Withdrawn: The attack vector described in the backing report required that an attacker gain access to a user's session cookie. By gaining access to the session cookie the attacker is for all intents and purposes the valid user and any access to user data would be expected.
~In SFTPGo 2.6.2, the JWT implementation lacks certain security measures, such as using JWT ID (JTI) claims, nonces, and proper expiration and invalidation mechanisms.~
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40430?
CVE-2024-40430 is considered a high severity vulnerability due to its potential impact on JWT security.
How do I fix CVE-2024-40430?
To fix CVE-2024-40430, upgrade SFTPGO to a version that properly implements JWT security measures.
What versions are affected by CVE-2024-40430?
CVE-2024-40430 affects SFTPGO version 2.6.2.
What are the consequences of exploiting CVE-2024-40430?
Exploiting CVE-2024-40430 can allow an attacker to impersonate another user by hijacking their JWT.
Is it necessary to steal a cookie to exploit CVE-2024-40430?
Yes, the prerequisite for exploiting CVE-2024-40430 is the ability to steal another user's cookie.