CVE-2025-24366

Aliases:GHSA-vj7w-3m8c-6vpxGO-2025-3458
Advisory lineage Upstream: 0 Downstream: 2
Deferred
Published: 07 Feb 2025, 21:16
Last modified:07 Feb 2025, 22:49

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
1.31% LOW
1% probability +0.65%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

07 Feb 2025, 21:16
Published
Vulnerability first disclosed
07 Feb 2025, 22:49
Last Modified
Vulnerability information updated

Description

SFTPGo is an open source, event-driven file transfer solution. SFTPGo supports execution of a defined set of commands via SSH. Besides a set of default commands some optional commands can be activated, one of them being `rsync`. It is disabled in the default configuration and it is limited to the local filesystem, it does not work with cloud/remote storage backends. Due to missing sanitization of the client provided `rsync` command, an authenticated remote user can use some options of the rsync command to read or write files with the permissions of the SFTPGo server process. This issue was fixed in version v2.6.5 by checking the client provided arguments. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 1.31%• Percentile: 80%

Techniques & Countermeasures

  • CWE-78•Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

    The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Affected Systems

  • drakkan•sftpgo

    ≥ 0.9.5, < 2.6.5

  • github.com/drakkan•sftpgo

    ≤ 1.2.2 | all

  • github.com/drakkan/sftpgo•v2

    ≥ 0.9.5, < 2.6.5 | < 2.6.5

References (4)