Executive Summary

This vulnerability exists in the Erlang OTP ssh_sftpd module, specifically in the SSH_FXP_READLINK handler. When an authenticated SFTP client creates a symbolic link inside a chrooted directory pointing to the root directory (/), the server resolves this symlink to the absolute backend filesystem path instead of the expected chrooted path. As a result, the server discloses the absolute filesystem path of the SFTP root directory and any symlink targets within it.

Importantly, this issue only leaks path information and does not expose file contents, credentials, or allow access to paths outside the root directory.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is limited to the exposure of absolute filesystem paths of the SFTP root directory and symlink targets within it. This information disclosure could reveal details about the host directory structure, mount points, or usernames if the root directory is under user home directories.

While no file contents or credentials are exposed, and no direct access outside the root directory is granted, the leaked information could potentially assist attackers in planning further attacks if combined with other vulnerabilities.

The vulnerability has a low severity score (CVSS 2.3) due to its limited impact on confidentiality, integrity, and availability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the behavior of the SSH_FXP_READLINK handler in the Erlang OTP ssh_sftpd module when handling symbolic links inside the chrooted SFTP root directory.

An authenticated SFTP client can create a symlink inside the chroot pointing to the root directory (/), then read the symlink back using the SSH_FXP_READLINK operation. If the server returns the absolute backend filesystem path (e.g., /data/sftp) instead of the chrooted path (/), the vulnerability is present.

Suggested commands to detect this issue include using an SFTP client to:

• Connect to the vulnerable SFTP server with valid credentials.
• Create a symbolic link inside the chrooted SFTP root directory pointing to the root directory: ln -s / symlink_name
• Use the SFTP client's readlink command or equivalent to read the symlink target: readlink symlink_name

If the returned path is an absolute backend path rather than the expected chrooted path, the vulnerability exists.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps for this vulnerability include:

• Apply the official patch provided by the Erlang/OTP project that fixes the ssh_sftpd module to properly canonicalize and chroot the target path before sending it to clients.
• Upgrade Erlang OTP to a fixed version: 29.0.2, 28.5.0.2, or 27.3.4.13 or later.
• Use OS-level chroot to isolate the SFTP server environment.
• Restrict SFTP server access to trusted networks and users only.
• Avoid storing sensitive information in directory paths under the SFTP root directory.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability exposes absolute filesystem paths of the SFTP root directory and symlink targets to an authenticated client, potentially revealing host directory structure, mount points, or usernames if the root is under sensitive directories like /home.

While this information disclosure does not include file contents, credentials, or access outside the root directory, it could assist further attacks if combined with other vulnerabilities.

Such exposure of system structure information may have implications for compliance with standards like GDPR or HIPAA, which require protection of sensitive information and minimization of data exposure, especially if directory paths contain personally identifiable information or sensitive organizational data.

Mitigations such as applying patches, using OS-level chroot, restricting SFTP server access, and avoiding sensitive information in directory paths can help reduce compliance risks.

Useful 0 Not Useful 0