CVE-2022-36071 Recovery codes abuse in SFTPGo

High 8.3 Published 2 Sep 2022 Updated 22 Apr 2025

Attackers with valid passwords can pre-generate recovery codes to bypass two-factor authentication in SFTPGo WebAdmin and WebClient.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-36071?

CVE-2022-36071 is a high-severity authentication bypass vulnerability in drakkan sftpgo, published on 2 Sep 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

SFTPGo is configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support. SFTPGo WebAdmin and WebClient support login using TOTP (Time-based One Time Passwords) as a secondary authentication factor. Because TOTPs are often configured on mobile devices that can be lost, stolen or damaged, SFTPGo also supports recovery codes. These are a set of one time use codes that can be used instead of the TOTP. In SFTPGo versions from version 2.2.0 to 2.3.3 recovery codes can be generated before enabling two-factor authentication. An attacker who knows the user's password could potentially generate some recovery codes and then bypass two-factor authentication after it is enabled on the account at a later time. This issue has been fixed in version 2.3.4. Recovery codes can now only be generated after enabling two-factor authentication and are deleted after disabling it.

Weakness: CWE-916, CWE-287

Which versions are affected by CVE-2022-36071?

4 open source packages ship an affected version, including github.com/drakkan/sftpgo/v2 and github.com/drakkan/sftpgo. It affects 1 product.

Package	Affected	Fixed in
`github.com/drakkan/sftpgo/v2` Go	From `2.2.0`	`2.3.4`
`github.com/drakkan/sftpgo/v2` Go	From `2.2.0`	`2.3.4`
`github.com/drakkan/sftpgo/v2` Go	From `2.2.0`	`2.3.4`
`github.com/drakkan/sftpgo` Go	All versions	None

Products include Sftpgo Project Sftpgo.

How do I fix CVE-2022-36071?

Upgrade github.com/drakkan/sftpgo/v2 to 2.3.4 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2022-36071 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-36071 exists.

Sources

Also known as GHSA-54qx-8p8w-xhg8, GO-2022-0964.