CVE-2022-36071: 
NixOS vulnerability analysis and mitigation

SFTPGo, a configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support, was found to have a vulnerability in its two-factor authentication (2FA) implementation between versions 2.2.0 and 2.3.3. The vulnerability relates to the generation of recovery codes for TOTP (Time-based One Time Passwords) authentication (GitHub Advisory, NVD).

The vulnerability stems from a design flaw in the recovery code generation process for TOTP authentication. The system allowed users to generate recovery codes before enabling two-factor authentication. These recovery codes were intended as backup authentication methods when users lose access to their TOTP devices. The issue was tracked as CVE-2022-36071 and was classified under CWE-287 (Improper Authentication) (MITRE CVE).

An attacker who possessed a user's password could generate recovery codes before two-factor authentication was enabled on the account. These pre-generated recovery codes would remain valid after 2FA was enabled, effectively allowing the attacker to bypass the additional security layer (GitHub Advisory).

The vulnerability was fixed in SFTPGo version 2.3.4. The patch ensures that recovery codes can only be generated after enabling two-factor authentication and are automatically deleted when 2FA is disabled. For affected versions, users can mitigate the risk by regenerating recovery codes after enabling two-factor authentication (GitHub Advisory).