Erlang/OTP SFTP Path Disclosure Vulnerability Advisory (CVE-2024-48959)

Vulnerability Overview Vulnerability Name: SFTP READLINK Response Leaks Absolute Backend Filesystem Path When Root is Configured Vulnerability Description: Impact: The handler in does not strip the backend prefix from symbolic link targets, resulting in the transmission of absolute paths to the client. Exploitation: An authenticated SFTP client can exploit this issue by creating symbolic links within the chroot jail. resolves the target to an absolute backend path and stores it on disk. When reading the symbolic link, returns the absolute path, e.g., , instead of the expected chroot value . Information Disclosure: The leaked information includes the absolute filesystem path of the SFTP root directory and the targets of any symbolic links. No file contents, credentials, or access paths beyond the root directory can be obtained through this issue. Affected Versions Affected Versions: - OTP: >= 17.0 - ssh: >= 3.0.1 Fixed Versions: - OTP: 29.0.2, 28.5.0.2, 27.3.4.13 - ssh: 6.0.1, 5.5.2.1, 5.2.11.8 Remediation Workarounds: - Use OS-level chroot to isolate the Erlang VM/SFTP server process in an independent filesystem environment, eliminating the dependency on the application-level option. - Ensure that the SFTP server port is not accessible from unauthorized machines on systems running the Erlang/OTP SFTP server. - Ensure that no sensitive information (usernames, project names, project topology) can be inferred from the absolute path of the configured root directory. Root Cause Fix: - Upgrade to the fixed versions: OTP 29.0.2, 28.5.0.2, 27.3.4.13, and ssh 6.0.1, 5.5.2.1, 5.2.11.8. Additional Information CVSS v4 Base Metrics: - Severity: Low (2.3 / 10) - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: Present - Privileges Required: Low - User Interaction: None - Vulnerable System Impact Metrics: - Confidentiality: Low - Integrity: None - Availability: None - Subsequent System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None CVE ID: CVE-2024-48959 Weakness: CWE-200 Contributors: - maennchen (Remediation developer) - Mikaku27 (Remediation developer) - u3s (Remediation reviewer) Acknowledgments: - Thanks to Jonatan Männchen for discovering and responsibly disclosing this vulnerability to the Erlang/OTP project.

Goal Reached Thanks to every supporter — we hit 100%!

Erlang/OTP SFTP Path Disclosure Vulnerability Advisory (CVE-2024-48959)

More from this source