CVE-2024-41258

Vulnerability

Filestash v0.4 (and earlier) uses ssh.InsecureIgnoreHostKey() in the SSH authentication component located at server/plugin/plg_backend_git/index.go. This call disables host key verification, meaning the client does not validate the identity of the SSH server it connects to. The vulnerability affects all versions up to and including v0.4, and is classified under CWE-305 (Authentication Bypass by Spoofing) and CWE-306 (Missing Authentication for Critical Function) [1].

Exploitation

An attacker needs to be in a position to intercept network traffic between the filestash instance and the targeted SSH server (i.e., a man-in-the-middle attack). No authentication or user interaction is required beyond the victim using filestash to initiate an SSH connection. The attacker can present any arbitrary host key, and filestash will accept it without verification, allowing the attacker to decrypt, modify, or inject traffic [1].

Impact

Successful exploitation allows the attacker to obtain sensitive information transmitted over the SSH connection, such as login credentials, file contents, or other data. This constitutes an information disclosure vulnerability with potential for further compromise of the SSH server or client systems [1].

Mitigation

As of the publication date (2024-07-31), no fixed version of filestash has been announced. The vendor has not released a patch or workaround. Users are advised to avoid using filestash with SSH connections until a fix is available, or to implement network-level controls (e.g., VPN) to reduce MITM risk [1].