Goshs
Monthly
Improper enforcement of the `--no-delete` flag in goshs WebDAV server allows unauthorized file deletion or overwrite. The `MOVE` handler incorrectly treats the verb as write-only without checking the delete restriction, permitting remote attackers using WebDAV clients to bypass the `--no-delete` boundary via a `MOVE` request with `Overwrite: T`. A public proof-of-concept exists, and the vendor has patched this in version 2.1.4.
Remote unauthenticated attackers can leak GitHub workflow tokens from goshs repositories via ArtiPACKED attack. The vulnerability exploits artifact packaging mechanisms to extract GITHUB_TOKEN credentials despite the token never appearing in source code. With CVSS 9.1 (Critical) and network attack vector requiring no authentication, this poses immediate risk to CI/CD pipelines using goshs. No public exploit identified at time of analysis, though the attack technique (ArtiPACKED) is documented. EPSS data unavailable; not listed in CISA KEV.
Critical authorization bypass in goshs (Go-based HTTP server) versions prior to 2.0.0-beta.4 allows unauthenticated attackers to upload, delete, and modify files in directories protected by .goshs ACL configurations. Attackers can execute state-changing operations (PUT uploads, POST /upload, directory creation via ?mkdir, file deletion via ?delete) without credentials, bypassing documented per-folder authentication mechanisms. Deleting the .goshs file itself removes authentication policies, enabling unrestricted access to previously protected content. Affects confidentiality, integrity, and availability of protected resources. No public exploit identified at time of analysis.
Path traversal in patrickhener goshs SFTP rename operation enables authenticated attackers to write files outside the configured root directory. Versions 1.0.7 through 2.0.0-beta.3 fail to sanitize destination paths in SFTP rename commands, allowing low-privileged users to overwrite arbitrary filesystem locations with network access. High integrity impact with scope change indicates potential host compromise. No public exploit identified at time of analysis.
A path equivalence bypass in goshs lets attackers retrieve blocked files and the ACL configuration file by appending a trailing slash to the request path. The sendFile handler derives the authorization-check filename from the raw URL while opening the file from the cleaned path, so a trailing slash yields an empty string for the check and defeats the block list and the rule that hides the .goshs file. No public exploit has been identified, but a proof-of-concept test is included in the patch; the vulnerability is not currently in CISA's Known Exploited Vulnerabilities catalog.
Path traversal in goshs file server allows unauthenticated remote attackers to write files outside the served directory by uploading a file with the name '..'. Affects versions up to 2.1.4; fixed in 2.1.5. The older v1 branch (<=1.1.4) remains vulnerable with no patch. No active exploitation has been reported.
goshs SimpleHTTPServer versions prior to 2.0.2 allow arbitrary file write via cross-origin PUT requests due to missing CSRF token validation on the PUT handler combined with permissive wildcard CORS headers. An attacker can trick a victim into visiting a malicious website which then writes arbitrary files to a goshs instance running on localhost or an internal network, bypassing network isolation protections. Publicly available exploit code exists, and the vulnerability affects all v2.x releases before 2.0.2 and all v1.x releases (no patch available for v1.x).
Improper enforcement of the `--no-delete` flag in goshs WebDAV server allows unauthorized file deletion or overwrite. The `MOVE` handler incorrectly treats the verb as write-only without checking the delete restriction, permitting remote attackers using WebDAV clients to bypass the `--no-delete` boundary via a `MOVE` request with `Overwrite: T`. A public proof-of-concept exists, and the vendor has patched this in version 2.1.4.
Remote unauthenticated attackers can leak GitHub workflow tokens from goshs repositories via ArtiPACKED attack. The vulnerability exploits artifact packaging mechanisms to extract GITHUB_TOKEN credentials despite the token never appearing in source code. With CVSS 9.1 (Critical) and network attack vector requiring no authentication, this poses immediate risk to CI/CD pipelines using goshs. No public exploit identified at time of analysis, though the attack technique (ArtiPACKED) is documented. EPSS data unavailable; not listed in CISA KEV.
Critical authorization bypass in goshs (Go-based HTTP server) versions prior to 2.0.0-beta.4 allows unauthenticated attackers to upload, delete, and modify files in directories protected by .goshs ACL configurations. Attackers can execute state-changing operations (PUT uploads, POST /upload, directory creation via ?mkdir, file deletion via ?delete) without credentials, bypassing documented per-folder authentication mechanisms. Deleting the .goshs file itself removes authentication policies, enabling unrestricted access to previously protected content. Affects confidentiality, integrity, and availability of protected resources. No public exploit identified at time of analysis.
Path traversal in patrickhener goshs SFTP rename operation enables authenticated attackers to write files outside the configured root directory. Versions 1.0.7 through 2.0.0-beta.3 fail to sanitize destination paths in SFTP rename commands, allowing low-privileged users to overwrite arbitrary filesystem locations with network access. High integrity impact with scope change indicates potential host compromise. No public exploit identified at time of analysis.
A path equivalence bypass in goshs lets attackers retrieve blocked files and the ACL configuration file by appending a trailing slash to the request path. The sendFile handler derives the authorization-check filename from the raw URL while opening the file from the cleaned path, so a trailing slash yields an empty string for the check and defeats the block list and the rule that hides the .goshs file. No public exploit has been identified, but a proof-of-concept test is included in the patch; the vulnerability is not currently in CISA's Known Exploited Vulnerabilities catalog.
Path traversal in goshs file server allows unauthenticated remote attackers to write files outside the served directory by uploading a file with the name '..'. Affects versions up to 2.1.4; fixed in 2.1.5. The older v1 branch (<=1.1.4) remains vulnerable with no patch. No active exploitation has been reported.
goshs SimpleHTTPServer versions prior to 2.0.2 allow arbitrary file write via cross-origin PUT requests due to missing CSRF token validation on the PUT handler combined with permissive wildcard CORS headers. An attacker can trick a victim into visiting a malicious website which then writes arbitrary files to a goshs instance running on localhost or an internal network, bypassing network isolation protections. Publicly available exploit code exists, and the vulnerability affects all v2.x releases before 2.0.2 and all v1.x releases (no patch available for v1.x).