GHSA-mpvx-whpp-99xj

Filestash skips TLS certificate verification process when sending out email verification codes

Source: GitHub Advisory Database (reviewed) High CVE-2024-41256

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/mickael-kerjean/filestash	<= 0.4	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate verification process when sending out email verification codes, possibly allowing attackers to access sensitive data via a man-in-the-middle attack.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-41256 advisory
https://github.com/mickael-kerjean/filestash/issues/709 web
https://gist.github.com/nyxfqq/a6da3fe6128b978ea1aaa5df639d5f98 web
https://github.com/mickael-kerjean/filestash package
https://github.com/mickael-kerjean/filestash/blob/master/server/model/share.go#L132 web
https://pkg.go.dev/vuln/GO-2024-3035 web