Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS00am1tLWM2anctZzc5Ns4AA-TP

Filestash configured to skip TLS certificate verification when using the FTPS protocol

filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a man-in-the-middle attack via the Init function of index.go.

Permalink: https://github.com/advisories/GHSA-4jmm-c6jw-g796
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00am1tLWM2anctZzc5Ns4AA-TP
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 2 months ago
Updated: 14 days ago

CVSS Score: 5.9
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Identifiers: GHSA-4jmm-c6jw-g796, CVE-2024-41255
References:

• https://nvd.nist.gov/vuln/detail/CVE-2024-41255
• https://gist.github.com/nyxfqq/c367f2ca9448810924dcf0f1af30b441
• https://github.com/mickael-kerjean/filestash/issues/710
• https://github.com/mickael-kerjean/filestash/blob/master/server/plugin/plg_backend_ftp/index.go#L108
• https://pkg.go.dev/vuln/GO-2024-3033
• https://github.com/advisories/GHSA-4jmm-c6jw-g796

Repository: https://github.com/mickael-kerjean/filestash
Blast Radius: 0.0

Affected Packages