stfpgo v2.7.6 Security Advisory: XSS, SCP Memory, Shared Link

Vulnerability Overview Security Fixes 1. Shared links not revoked: Shared links were not revoked when the owner’s account was disabled or expired. - Reporter: GHSA-5jbj-cjcp-rr8p 2. Memory allocation issue in SCP protocol record parsing: There was an unbounded memory allocation during SCP protocol record parsing. - Reporter: GHSA-4dw8-6qjf-fywg 3. WebClient cross-site scripting (XSS): Cross-site scripting stored via directory names. - Reporter: ERWN - Report Link: GHSA-f9qc-3v4f-32w3 4. File pattern filter not evaluated: The file pattern filter was not evaluated for copy sources. - Report Link: GHSA-ww9v-q5x4-966g Scope of Impact Shared links not revoked: Affects all users utilizing shared links, particularly when the owner’s account is disabled or expired. Memory allocation issue in SCP protocol record parsing: Affects users employing the SCP protocol, potentially leading to memory exhaustion. WebClient cross-site scripting (XSS): Affects users of WebClient, particularly those vulnerable to XSS attacks via directory names. File pattern filter not evaluated: Affects all users relying on file pattern filters, potentially leading to security vulnerabilities. Remediation 1. Shared links not revoked: Ensure that all shared links are automatically revoked when the owner’s account is disabled or expires. 2. Memory allocation issue in SCP protocol record parsing: Restrict memory allocation during SCP protocol record parsing to prevent memory exhaustion. 3. WebClient cross-site scripting (XSS): Implement input validation and escaping for directory names to prevent cross-site scripting attacks. 4. File pattern filter not evaluated: Ensure the file pattern filter is properly evaluated to guarantee correct functionality. Other Fixes Bug fixes: - WebDAV: Returns the correct ETag after upload, or returns no ETag if unavailable. - Instance startup: If the admin table is empty, the setup page is provided until restart; instances using shared SQL providers now re-check the database. - OIDC: Binds authorization requests to the user agent. Hardening Measures Download limits: When restricting downloads to shared files in a single directory, ZIP archives may expand to the owner’s entire filesystem; this only affects the in-memory data provider, while other data providers are unaffected. SFTP: Reading the entire file to compute file hashes now requires download permissions; previously, list permissions were sufficient. Self-service updates: When users change their password, profile, or two-step verification settings, the entire user profile is written, which may overwrite concurrent administrative changes. httpd: JWT invalidation is now based on token ID. Invalid tokens are matched by exact token text, so equivalent Base64URL spellings no longer match stored entries and will cease working after logout. Packaging: Data directory permissions are hardened during installation; a warning is issued at startup if the effective UID is 0. Contributors corbanvilla, dderiyam, and two additional contributors Assets Multiple versions of the package are provided, including support for various architectures and operating systems. Summary This page primarily details the security fixes and hardening measures in stfpgo v2.7.6, addressing issues related to shared links, SCP protocol, WebClient cross-site scripting, and file pattern filters, along with corresponding remediation steps.

Goal Reached Thanks to every supporter — we hit 100%!

stfpgo v2.7.6 Security Advisory: XSS, SCP Memory, Shared Link

More from this source