CVE-2021-36370
📋 TL;DR
This vulnerability in Midnight Commander's SFTP implementation fails to verify server fingerprints during connection establishment. This allows man-in-the-middle attackers to intercept SFTP connections without detection. Users of Midnight Commander who connect to SFTP servers are affected.
💻 Affected Systems
- Midnight Commander
📦 What is this software?
Midnight Commander by Midnight Commander
⚠️ Risk & Real-World Impact
Worst Case
Attackers can intercept all SFTP traffic, steal credentials, modify transferred files, or inject malicious content into file transfers.
Likely Case
Credential theft and data exfiltration from SFTP connections in untrusted networks.
If Mitigated
Limited impact if using VPNs, trusted networks, or alternative secure file transfer methods.
🎯 Exploit Status
Standard MITM techniques work; no special exploitation required beyond network positioning.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.8.27 and later
Vendor Advisory: https://midnight-commander.org/
Restart Required: No
Instructions:
1. Update Midnight Commander to version 4.8.27 or later using your distribution's package manager. 2. For source installations: download latest release from official site and recompile.
🔧 Temporary Workarounds
Use SSH instead of SFTP
linuxUse SSH command-line tools for file transfers instead of Midnight Commander's SFTP
scp user@host:/path/to/file /local/path
sftp user@host
Disable SFTP in Midnight Commander
linuxConfigure Midnight Commander to not use SFTP protocol
Edit ~/.mc/ini or /etc/mc/mc.ini and remove SFTP from protocols
🧯 If You Can't Patch
- Use VPN for all SFTP connections to trusted networks
- Verify server fingerprints manually using ssh-keyscan before connecting
🔍 How to Verify
Check if Vulnerable:
Check Midnight Commander version: mc --version | grep -i versionCheck Version:
mc --versionVerify Fix Applied:
Confirm version is 4.8.27 or higher and test SFTP connection shows fingerprint verification📡 Detection & Monitoring
Log Indicators:
- Multiple failed SFTP connections
- SFTP connections to unexpected IPs
Network Indicators:
- Unusual SFTP traffic patterns
- MITM tools like ettercap or bettercap in network
SIEM Query:
source="midnight-commander" AND (event="sftp_connection" OR protocol="SFTP")🔗 References
- https://docs.ssh-mitm.at/CVE-2021-36370.html
- https://github.com/MidnightCommander/mc/blob/5c1d3c55dd15356ec7d079084d904b7b0fd58d3e/src/vfs/sftpfs/connection.c#L484
- https://github.com/MidnightCommander/mc/blob/master/src/vfs/sftpfs/connection.c
- https://mail.gnome.org/archives/mc-devel/2021-August/msg00008.html
- https://midnight-commander.org/
- https://sourceforge.net/projects/mcwin32/files/
- https://docs.ssh-mitm.at/CVE-2021-36370.html
- https://github.com/MidnightCommander/mc/blob/5c1d3c55dd15356ec7d079084d904b7b0fd58d3e/src/vfs/sftpfs/connection.c#L484
- https://github.com/MidnightCommander/mc/blob/master/src/vfs/sftpfs/connection.c
- https://mail.gnome.org/archives/mc-devel/2021-August/msg00008.html
- https://midnight-commander.org/
- https://sourceforge.net/projects/mcwin32/files/
