Path Traversal in Erlang OTP SSH SFTP Module

Executive Summary

This vulnerability is an Observable Response Discrepancy issue in the Erlang OTP SSH SFTP server (ssh_sftpd module). It allows an authenticated SFTP user to determine whether files or directories exist outside the configured root directory by exploiting the SSH_FXP_REALPATH operation.

The problem arises because the SSH_FXP_REALPATH handler uses a non-canonicalized path, which bypasses the usual root directory checks. This lets the attacker send specially crafted path traversal requests that the server processes differently depending on whether the target path exists or not.

As a result, the server's differing responses create a path-existence oracle, enabling the attacker to enumerate the filesystem structure outside the intended root directory, including sensitive files and directories.

Importantly, this vulnerability only leaks information about the existence of paths; it does not allow access to file contents, credentials, or write permissions by itself.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an authenticated SFTP user to enumerate files and directories outside the configured root directory, revealing the presence of sensitive files, directories, and mount points.

While it does not provide direct access to file contents, credentials, or modification capabilities, the information gained can be used for further attacks by mapping the filesystem structure and identifying valuable targets.

This reconnaissance capability can aid attackers in planning more sophisticated exploits or lateral movement within the system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by observing if an authenticated SFTP user can send a REALPATH request with crafted traversal paths and receive different responses based on the existence of files or directories outside the configured root directory.

Specifically, an attacker or tester can attempt to send SSH_FXP_REALPATH requests with path traversal sequences (e.g., /valid_dir/../../../etc/passwd) and check if the server responds with SSH_FXP_NAME when the path exists or SSH_FX_NO_SUCH_FILE when it does not.

To detect this on your system, you can use an SFTP client or scripting tool to send such crafted REALPATH requests and observe the server responses for discrepancies indicating path existence enumeration.

There are no explicit commands provided in the resources, but using an SFTP client with verbose logging or a custom script to send REALPATH requests with traversal paths and analyzing the responses would be the approach.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include applying the available patches that fix the vulnerability by adding root directory validation in the SSH_FXP_REALPATH handler to prevent path traversal outside the configured root.

If patching is not immediately possible, workarounds include using OS-level chroot to restrict the SFTP server's filesystem view, restricting access to the SFTP server to trusted users only, and avoiding sensitive information in path structures.

Upgrading Erlang/OTP to versions 29.0.3, 28.5.0.3, or 27.3.4.14 or later, where the fix has been applied, is recommended.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory, potentially revealing the presence of sensitive files and directory structures.

Although the vulnerability does not allow access to file contents, credentials, or write operations by itself, the information leakage about filesystem structure could assist further attacks that might compromise sensitive data.

From a compliance perspective, this information disclosure could pose risks under regulations like GDPR or HIPAA, which require protection of sensitive data and prevention of unauthorized information disclosure.

Organizations relying on Erlang OTP SSH SFTP servers affected by this vulnerability should consider the risk of indirect data exposure and take mitigation steps such as applying patches, using OS-level chroot, restricting SFTP access, and avoiding sensitive information in path structures to maintain compliance.

Useful 0 Not Useful 0