F5-K000163738: Medium severity F5 BIG-IP Next CNF vulnerability
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.3.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.8.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.8.2
Event History
Frequently Asked Questions
What interaction is required for exploitation?
A user must run sftp with the form "sftp server:/path ." and connect to an attacker-controlled server. This is not a purely passive network attack; user interaction is required.
What is the impact if exploitation succeeds?
The issue can allow downloaded files to be placed outside the intended location. The stated impact is low integrity and availability impact, with no confidentiality impact.
Which deployments should be reviewed?
Review the listed F5 products for use of OpenSSH sftp, especially workflows where users download from externally controlled or untrusted SFTP servers using a destination of the current directory.