PT-2024-29335 · Filestash · Filestash
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
filestash version 0.4
Description
An issue was discovered where the usage of the ssh.InsecureIgnoreHostKey() function disables host key verification. This could possibly allow attackers to obtain sensitive information via a man-in-the-middle attack.
Recommendations
For filestash version 0.4, consider disabling the use of ssh.InsecureIgnoreHostKey() to re-enable host key verification until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.
Exploit
Fix
Improper Verification of Cryptographic Signature
Improper Certificate Validation
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Filestash