GHSA-4jmm-c6jw-g796

Filestash configured to skip TLS certificate verification when using the FTPS protocol

Source: GitHub Advisory Database (reviewed) High CVE-2024-41255

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/mickael-kerjean/filestash	<= 0.4	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a man-in-the-middle attack via the Init function of index.go.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-41255 advisory
https://github.com/mickael-kerjean/filestash/issues/710 web
https://gist.github.com/nyxfqq/c367f2ca9448810924dcf0f1af30b441 web
https://github.com/advisories/GHSA-4jmm-c6jw-g796 advisory
https://github.com/mickael-kerjean/filestash package
https://github.com/mickael-kerjean/filestash/blob/master/server/plugin/plg_backend_ftp/index.go#L108 web
https://pkg.go.dev/vuln/GO-2024-3033 web