GHSA-wwv9-g5x4-966q: Medium severity go/github.com/drakkan/sftpgo/v2 vulnerability
Summary
File pattern filters (deniedpatterns / allowedpatterns) were evaluated on the destination of a copy only. A user holding the copy permission could copy a file denied by the filters to a permitted name and then read it. A recursive directory copy reproduced the contents of a restricted directory under a path where the filters do not deny them, and the hide policy was affected in the same way: a file reported as missing by stat and by directory listings could still be copied.
Details
An authenticated user can read the contents of files that the file pattern filters are configured to deny them. Nothing else is bypassed: the home directory, the virtual folder layout and the per-directory permissions are all still enforced, and both ends of the copy are paths the account can already reach. No access to other accounts and no administrative capability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/drakkan/sftpgo/v2to a version that resolves this vulnerability.Fixed in 2.7.6
Event History
Frequently Asked Questions
Who is exposed to this issue?
Authenticated users who have copy permission may be able to read files that pattern-based filters or hide policies are intended to deny. Exposure is limited to paths the user's account can already reach within its home directory, virtual folder layout, and per-directory permissions.
What does an attacker need to exploit it?
The attacker needs an authenticated account with permission to copy files. They must be able to reach both the restricted source path and a destination path whose name is permitted by the configured filters.
Can this provide access to other users' files or administrative functions?
No. The issue does not bypass home-directory boundaries, virtual folder layout, per-directory permissions, other-account isolation, or administrative access controls.
How can a hidden or denied file be read through this issue?
A user can copy a denied or hidden file to a destination name that is not denied by the configured patterns, then read the copied file. Recursive directory copies can similarly reproduce restricted directory contents under a permitted path.