CVE-2018-20684: Improper Input Validation (CWE-20)
value: In WinSCP before 5.14 beta, due to missing validation, the scp implementation would accept arbitrary files sent by the server, potentially overwriting unrelated files. This affects TSCPFileSystem::SCPSink in core/ScpFileSystem.cpp.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2019-01-10T21:29Z
Repository: https://github.com/winscp/winscp
Language: Other
Files changed: source/core/ScpFileSystem.cpp, source/resource/TextsCore.h, source/resource/TextsCore1.rc
Commit date: 2018-09-04 01:54:28 +0200
Commit message: Bug 1675: Prevent SCP server sending files that were not requested

https://winscp.net/tracker/1675

Source commit: 4aa587620973bf793fb6e783052277c0f7be4b55

Diff: diff --git a/source/core/ScpFileSystem.cpp b/source/core/ScpFileSystem.cpp
index f5a06b9f..40dcb540 100644
--- a/source/core/ScpFileSystem.cpp
+++ b/source/core/ScpFileSystem.cpp
@@ -2359,10 +2359,14 @@ void __fastcall TSCPFileSystem::SCPSink(const UnicodeString TargetDir,
           UnicodeString OnlyFileName = UnixExtractFileName(Line);
           if (Line != OnlyFileName)
           {
             FTerminal->LogEvent(FORMAT(L"Warning: Remote host set a compound pathname '%s'", (Line)));
           }
+          if ((Level == 0) && (OnlyFileName != UnixExtractFileName(FileName)))
+          {
+            SCPError(LoadStr(UNREQUESTED_FILE), False);
+          }
 
           FullFileName = SourceDir + OnlyFileName;
           OperationProgress->SetFile(FullFileName);
           OperationProgress->SetTransferSize(TSize);
         }
diff --git a/source/resource/TextsCore.h b/source/resource/TextsCore.h
index 905e1510..4f4f70a8 100644
--- a/source/resource/TextsCore.h
+++ b/source/resource/TextsCore.h
@@ -268,10 +268,11 @@
 #define S3_ERROR_FURTHER_DETAILS 744
 #define S3_ERROR_EXTRA_DETAILS  745
 #define S3_STATUS_ACCESS_DENIED 746
 #define UNKNOWN_FILE_ENCRYPTION 747
 #define INVALID_ENCRYPT_KEY     748
+#define UNREQUESTED_FILE        749
 
 #define CORE_CONFIRMATION_STRINGS 300
 #define CONFIRM_PROLONG_TIMEOUT3 301
 #define PROMPT_KEY_PASSPHRASE   303
 #define FILE_OVERWRITE          304
diff --git a/source/resource/TextsCore1.rc b/source/resource/TextsCore1.rc
index 32c6364d..ee50347a 100644
--- a/source/resource/TextsCore1.rc
+++ b/source/resource/TextsCore1.rc
@@ -239,10 +239,11 @@ BEGIN
   S3_STATUS_ACCESS_DENIED, "Access denied."
   DUPLICATE_FOLDER_NOT_SUPPORTED, "Direct duplication of folders is not supported. Use a duplication via a local temporary copy."
   MISSING_TARGET_BUCKET, "Specify target bucket."
   UNKNOWN_FILE_ENCRYPTION, "File is not encrypted using a known encryption."
   INVALID_ENCRYPT_KEY, "**Invalid encryption key.**\n\nEncryption key for %s encryption must have %d bytes. It must be entered in hexadecimal representation (i.e. %d characters)."
+  UNREQUESTED_FILE, "Server sent a file that was not requested."
 
   CORE_CONFIRMATION_STRINGS, "CORE_CONFIRMATION"
   CONFIRM_PROLONG_TIMEOUT3, "Host is not communicating for %d seconds.\n\nWait for another %0:d seconds?"
   PROMPT_KEY_PASSPHRASE, "&Passphrase for key '%s':"
   FILE_OVERWRITE, "File '%s' already exists. Overwrite?"

Fixed code:           if ((Level == 0) && (OnlyFileName != UnixExtractFileName(FileName)))
          {
            SCPError(LoadStr(UNREQUESTED_FILE), False);
          }
#define UNREQUESTED_FILE        749
  UNREQUESTED_FILE, "Server sent a file that was not requested."