fix: SftpUploader uses StrictHostKeyChecking=no — vulnerable to MITM #182

New Issue

2026-06-29T14:39:48Z

jmiller commented

2026-06-29 14:39:48 +00:00

Summary

SftpUploader.php:210,238 passes -o StrictHostKeyChecking=no to both scp and ssh commands. This disables SSH host key verification on every connection, making SFTP uploads vulnerable to man-in-the-middle attacks.

Location

src/Engine/SftpUploader.php:210 (buildScpCommand)
src/Engine/SftpUploader.php:238 (buildSshCommand)

Fix

Change to StrictHostKeyChecking=accept-new — trusts on first connect, rejects if the key changes. Optionally allow users to provide a known_hosts path in the profile config.

## Summary `SftpUploader.php:210,238` passes `-o StrictHostKeyChecking=no` to both scp and ssh commands. This disables SSH host key verification on every connection, making SFTP uploads vulnerable to man-in-the-middle attacks. ## Location - `src/Engine/SftpUploader.php:210` (buildScpCommand) - `src/Engine/SftpUploader.php:238` (buildSshCommand) ## Fix Change to `StrictHostKeyChecking=accept-new` — trusts on first connect, rejects if the key changes. Optionally allow users to provide a known_hosts path in the profile config.

jmiller added the component: remote label 2026-06-29 14:39:48 +00:00

jmiller commented

2026-06-29 14:39:53 +00:00

Branch created: feature/182-fix-sftpuploader-uses-stricthostkeycheck

git fetch origin
git checkout feature/182-fix-sftpuploader-uses-stricthostkeycheck

Branch created: [`feature/182-fix-sftpuploader-uses-stricthostkeycheck`](https://git.mokoconsulting.tech/MokoConsulting/MokoSuiteBackup/src/branch/feature/182-fix-sftpuploader-uses-stricthostkeycheck) ```bash git fetch origin git checkout feature/182-fix-sftpuploader-uses-stricthostkeycheck ```

Sign in to join this conversation.

Priority Medium

Type Feature

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoSuiteBackup#182