high5.9
CVE-2024-41255
Filestash configured to skip TLS certificate verification when using the FTPS protocol
Impact
filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a man-in-the-middle attack via the Init function of index.go.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/mickael-kerjean/filestash | <= 0.4 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Filestash | Filestash | Version 0.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://gist.github.com/nyxfqq/c367f2ca9448810924dcf0f1af30b441
- https://github.com/advisories/GHSA-4jmm-c6jw-g796
- https://nvd.nist.gov/vuln/detail/CVE-2024-41255
- https://github.com/mickael-kerjean/filestash/issues/710
- https://github.com/mickael-kerjean/filestash/blob/master/server/plugin/plg_backend_ftp/index.go#L108
- https://pkg.go.dev/vuln/GO-2024-3033