Goshs Labs
Monthly
Improper enforcement of the `--no-delete` flag in goshs WebDAV server allows unauthorized file deletion or overwrite. The `MOVE` handler incorrectly treats the verb as write-only without checking the delete restriction, permitting remote attackers using WebDAV clients to bypass the `--no-delete` boundary via a `MOVE` request with `Overwrite: T`. A public proof-of-concept exists, and the vendor has patched this in version 2.1.4.
A path equivalence bypass in goshs lets attackers retrieve blocked files and the ACL configuration file by appending a trailing slash to the request path. The sendFile handler derives the authorization-check filename from the raw URL while opening the file from the cleaned path, so a trailing slash yields an empty string for the check and defeats the block list and the rule that hides the .goshs file. No public exploit has been identified, but a proof-of-concept test is included in the patch; the vulnerability is not currently in CISA's Known Exploited Vulnerabilities catalog.
Path traversal in goshs file server allows unauthenticated remote attackers to write files outside the served directory by uploading a file with the name '..'. Affects versions up to 2.1.4; fixed in 2.1.5. The older v1 branch (<=1.1.4) remains vulnerable with no patch. No active exploitation has been reported.
Improper enforcement of the `--no-delete` flag in goshs WebDAV server allows unauthorized file deletion or overwrite. The `MOVE` handler incorrectly treats the verb as write-only without checking the delete restriction, permitting remote attackers using WebDAV clients to bypass the `--no-delete` boundary via a `MOVE` request with `Overwrite: T`. A public proof-of-concept exists, and the vendor has patched this in version 2.1.4.
A path equivalence bypass in goshs lets attackers retrieve blocked files and the ACL configuration file by appending a trailing slash to the request path. The sendFile handler derives the authorization-check filename from the raw URL while opening the file from the cleaned path, so a trailing slash yields an empty string for the check and defeats the block list and the rule that hides the .goshs file. No public exploit has been identified, but a proof-of-concept test is included in the patch; the vulnerability is not currently in CISA's Known Exploited Vulnerabilities catalog.
Path traversal in goshs file server allows unauthenticated remote attackers to write files outside the served directory by uploading a file with the name '..'. Affects versions up to 2.1.4; fixed in 2.1.5. The older v1 branch (<=1.1.4) remains vulnerable with no patch. No active exploitation has been reported.