CVE-2024-40430
First published: Mon Jul 22 2024(Updated: )
In SFTPGO 2.6.2, the JWT implementation lacks certain security measures, such as using JWT ID (JTI) claims, nonces, and proper expiration and invalidation mechanisms. NOTE: The vendor argues that the prerequisite for this exploit is to be able to steal another user's cookie. Additionally, it is argued that SFTPGo validates cookies being used by the IP address it was issued to, so stolen cookies from different IP addresses will not work.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/github.com/drakkan/sftpgo/v2 | <=2.6.2 | |
| SFTPGo project SFTPGo | =2.6.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-40430?
CVE-2024-40430 is considered a high severity vulnerability due to its potential impact on JWT security.
How do I fix CVE-2024-40430?
To fix CVE-2024-40430, upgrade SFTPGO to a version that properly implements JWT security measures.
What versions are affected by CVE-2024-40430?
CVE-2024-40430 affects SFTPGO version 2.6.2.
What are the consequences of exploiting CVE-2024-40430?
Exploiting CVE-2024-40430 can allow an attacker to impersonate another user by hijacking their JWT.
Is it necessary to steal a cookie to exploit CVE-2024-40430?
Yes, the prerequisite for exploiting CVE-2024-40430 is the ability to steal another user's cookie.
- agent/first-publish-date
- agent/type
- agent/author
- agent/weakness
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-x72p-g37q-4xr9
- alias/CVE-2024-40430
- agent/software-canonical-lookup
- agent/references
- agent/severity
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/status
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/event
- agent/description
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-cve
- agent/software-canonical-lookup-request
- package-manager/go
- status/rejected
- vendor/sftpgo project
- canonical/sftpgo project sftpgo
- version/sftpgo project sftpgo/2.6.2