Skip to content

Brute force takeover of OpenID Connect session cookies

Moderate
drakkan published GHSA-6943-qr24-82vx Nov 28, 2024

Package

gomod sftpgo (Go)

Affected versions

>= 2.3.0, < 2.6.4

Patched versions

2.6.4

Description

Impact

The OpenID Connect implementation, in the affected SFTPGo versions, allows authenticated users to brute force session cookies and thereby gain access to other users' data, since the cookies are generated predictably using the xid library and are therefore unique but not cryptographically secure.

Patches

This issue was fixed in version v2.6.4, where cookies are opaque and cryptographically secure strings.

References

f30a9a2

Severity

Moderate

CVE ID

CVE-2024-52801

Weaknesses

No CWEs

Credits