TI-2024-35314 Aliases CVE-2024-52801 GHSA-6943-qr24-82vx

Brute force takeover of OpenID Connect session cookies in sftpgo

LOW 24CWE-327Published 2024-11-29 · Updated 2024-12-02

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-327.

Summary

sftpgo is a full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, FTP/S, WebDAV. The OpenID Connect implementation allows authenticated users to brute force session cookies and thereby gain access to other users' data, since the cookies are generated predictably using the xid library and are therefore unique but not cryptographically secure. This issue was fixed in version v2.6.4, where cookies are opaque and cryptographically secure strings. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00405 34th percentileScored 2026-11-07

Fix Fixed sftpgo (drakkan): 2.6.4github.com/drakkan/sftpgo/v2 (Go): 2.6.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
drakkan	sftpgo	2.3.0 to before 2.6.4	2.6.4	Patch available	CNA
—	github.com/drakkan/sftpgo/v2 (Go)	2.3.0 to before 2.6.4	2.6.4	Patch available	GHSA-6943-qr24-82vx

sftpgo Vendordrakkan Affected 2.3.0 to before 2.6.4 Fixed in 2.6.4 Patch available CNA
github.com/drakkan/sftpgo/v2 (Go) Vendor— Affected 2.3.0 to before 2.6.4 Fixed in 2.6.4 Patch available GHSA-6943-qr24-82vx

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:sftpgo_project:sftpgo::::::::	—	—	drakkan

cpe:2.3:a:sftpgo_project:sftpgo:*:*:*:*:*:*:*:* Versions — — ·drakkan

Remediation

Fix · CNA sftpgo (drakkan) Fixed in 2.6.4
Fix · GHSA-6943-qr24-82vx github.com/drakkan/sftpgo/v2 (Go) Fixed in 2.6.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-52801
2026-10-03 Alias added: GHSA-6943-qr24-82vx

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-52801

Other 4

TI-2022-16494 Recovery codes abuse in SFTPGo CVSS 3.1HIGH 8.3
TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
TI-2025-18109 Insufficient sanitization of user provided rsync command in SFTPGo CVSS 3.1HIGH 7.5
TI-2026-71799 Denial of service in SFTPGo via malformed SSH channel request CVSS 3.1MEDIUM 6.5
TI-2022-18599 XSS Vulnerabilities in WebClient CVSS 3.1MEDIUM 6.1
TI-2026-36441 SFTPGo: Path confinement bypass in public browsable share partial ZIP download CVSS 3.1MEDIUM 5.9

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences