An attacker who knows the user's password could potentially generate some recovery codes and then bypass two-factor authentication after it is enabled on the account at a later time.

In SFTPGo versions from version 2.2.0 to 2.3.3 recovery codes can be generated before enabling two-factor authentication. These are a set of one time use codes that can be used instead of the TOTP. Because TOTPs are often configured on mobile devices that can be lost, stolen or damaged, SFTPGo also supports recovery codes.

SFTPGo WebAdmin and WebClient support login using TOTP (Time-based One Time Passwords) as a secondary authentication factor. SFTPGo is configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support. This would allow the attacker to execute code within the context of the victim's browser. It is possible for a remote attacker to inject arbitrary JavaScript into a WS_FTP administrator's web session.

In Progress WS_FTP Server prior to version 8.7.3, multiple reflected cross-site scripting (XSS) vulnerabilities exist in the administrative web interface. In Progress WS_FTP Server prior to version 8.7.3, forms within the administrative interface did not include a nonce to mitigate the risk of cross-site request forgery (CSRF) attacks. This could allow a remote attacker to generate a denial of service condition on devices that incorporate a vulnerable version of the FTP server. The FTP server does not properly release memory resources that were reserved for incomplete connection attempts by FTP clients. A vulnerability has been identified in Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions), Nucleus Source Code (Versions including affected FTP server).

Cyberduck sftp nested server