Executive Summary

This vulnerability exists in SFTPGo versions before v2.7.1 and involves improper input validation when handling dynamic group paths such as home directories or key prefixes. Specifically, when placeholders like %username% are used to define these paths, the value replacing the placeholder is not properly sanitized against relative path components. This means that if a user is created with a specially crafted username, the resulting path could point to a parent directory instead of the intended sub-directory.

The issue allows path traversal through crafted usernames, potentially leading to unauthorized access or manipulation of files outside the intended directory structure.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker to bypass intended directory restrictions. By exploiting the input validation flaw with a crafted username, an attacker could cause the system to resolve file paths to parent directories, potentially accessing or modifying files outside their authorized area.

Such unauthorized access could lead to data exposure, data corruption, or other security breaches depending on the files accessible through the path traversal.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade SFTPGo to version v2.7.1 or later, where the input validation issue with dynamic group paths has been fixed.

Useful 0 Not Useful 0