GHSA-q8m6-9rfx-39rf: AsyncSSH: SFTP Recursive Copy Path Traversal via Unsanitized Server-Supplied Filenames
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, recursive remote-to-local SFTP copies in SFTPClient.copy() in asyncssh/sftp.py, reached through get(), mget(), and copy(), trust filenames returned by a remote server's directory enumeration. A malicious or compromised SFTP server can return an absolute filename or a filename containing path separators and parent-directory traversal, causing destination path construction to escape the requested local directory and write attacker-selected content to locations writable by the client process. This issue is fixed in version 2.24.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
python/asyncsshto a version that resolves this vulnerability.Fixed in 2.24.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Clients using AsyncSSH before 2.24.1 are exposed when they perform recursive remote-to-local SFTP copies through get(), mget(), or copy() against a malicious or compromised SFTP server. The server can influence filenames returned during directory enumeration.
What does an attacker need to exploit it?
An attacker needs control of, or the ability to compromise, the SFTP server involved in the recursive copy. They must cause the client to initiate a recursive remote-to-local copy; no client-side privileges are required by the vector, but user interaction is required.
What can the attacker do on a vulnerable client?
The attacker can supply absolute paths or names containing path separators and parent-directory traversal sequences. This can cause attacker-selected content to be written outside the requested destination directory, limited to locations writable by the client process.
How can this be remediated?
Upgrade AsyncSSH to version 2.24.1, which fixes the filename handling in recursive SFTP copies. If upgrading is not immediately possible, avoid recursive remote-to-local copies from untrusted or potentially compromised SFTP servers.