{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/goshs/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["goshs (\u003c= 1.1.4)","goshs/v2 (\u003c= 2.1.0)"],"_cs_severities":["high"],"_cs_tags":["authorization-bypass","webserver","vulnerability","cve","information-disclosure"],"_cs_type":"advisory","_cs_vendors":["patrickhener"],"content_html":"\u003cp\u003eA high-severity authorization bypass vulnerability, tracked as CVE-2026-54719, has been identified in \u003ccode\u003egoshs\u003c/code\u003e (versions \u0026lt;= 1.1.4) and \u003ccode\u003egoshs/v2\u003c/code\u003e (versions \u0026lt;= 2.1.0) which allows unauthenticated attackers to read arbitrary files. This flaw is a residual vulnerability from a previous fix (GHSA-wvhv-qcqf-f3cx) which addressed ACL bypasses on state-changing routes but failed to cover the \u003ccode\u003e?bulk\u003c/code\u003e zip-download endpoint. The \u003ccode\u003ebulkDownload\u003c/code\u003e function, invoked by requests containing \u003ccode\u003e?bulk\u003c/code\u003e and \u003ccode\u003e?file=\u003c/code\u003e parameters, retrieves file contents as a ZIP archive without performing the necessary \u003ccode\u003e.goshs\u003c/code\u003e ACL checks or honoring per-file block lists. This critical oversight enables any unauthenticated network attacker to bypass folder-level and file-level access controls, leading to unauthorized disclosure of confidential information from files located under the webroot. The vulnerability does not affect write or delete operations, limiting the impact to confidentiality only.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker identifies a vulnerable \u003ccode\u003egoshs\u003c/code\u003e instance exposed on the network.\u003c/li\u003e\n\u003cli\u003eThe attacker attempts to access a known protected file directly (e.g., \u003ccode\u003eGET /protected/secret.txt\u003c/code\u003e), which is correctly denied with a 401 Unauthorized response by the server's standard authorization flow.\u003c/li\u003e\n\u003cli\u003eThe attacker then crafts a malicious HTTP GET request targeting the \u003ccode\u003e?bulk\u003c/code\u003e zip-download route, appending the \u003ccode\u003e?file=\u003c/code\u003e parameter with the path to the desired protected file (e.g., \u003ccode\u003eGET /?bulk\u0026amp;file=/protected/secret.txt\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003egoshs\u003c/code\u003e server receives this request and routes it to the \u003ccode\u003ebulkDownload\u003c/code\u003e function, bypassing the normal authorization gates.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ebulkDownload\u003c/code\u003e function processes the \u003ccode\u003e?file=\u003c/code\u003e parameter, retrieves the content of \u003ccode\u003e/protected/secret.txt\u003c/code\u003e, and streams it back to the attacker within a ZIP archive.\u003c/li\u003e\n\u003cli\u003eThe attacker extracts the ZIP archive to obtain the contents of the confidential file, completely circumventing the \u003ccode\u003e.goshs\u003c/code\u003e ACL protections and any per-file block lists.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-54719 leads to unauthorized information disclosure, specifically the confidentiality of any file stored under the \u003ccode\u003egoshs\u003c/code\u003e webroot that relies solely on \u003ccode\u003e.goshs\u003c/code\u003e ACLs for protection. While a server-wide basic authentication mechanism (\u003ccode\u003e-b\u003c/code\u003e flag) would still gate the \u003ccode\u003e?bulk\u003c/code\u003e route, deployments relying on per-folder \u003ccode\u003e.goshs\u003c/code\u003e ACLs are vulnerable. Attackers can exfiltrate sensitive data such as configuration files, user data, or intellectual property without any authentication, posing a significant risk to data privacy and security. The vulnerability does not allow for data modification or deletion.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetects CVE-2026-54719 Exploitation - Goshs bulk download ACL bypass\u003c/code\u003e to your SIEM to identify attempts to exploit this vulnerability.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for \u003ccode\u003eGET\u003c/code\u003e requests to \u003ccode\u003e/?bulk\u003c/code\u003e containing the \u003ccode\u003efile=\u003c/code\u003e parameter, as these indicate potential exploitation attempts.\u003c/li\u003e\n\u003cli\u003eApply the latest security patches from \u003ccode\u003egoshs\u003c/code\u003e developers immediately, which should enforce \u003ccode\u003e.goshs\u003c/code\u003e ACLs within the \u003ccode\u003ebulkDownload\u003c/code\u003e function or route \u003ccode\u003e?bulk\u003c/code\u003e requests through the same authorization gate as normal read paths.\u003c/li\u003e\n\u003cli\u003eConduct an audit of other alternate read routes such as \u003ccode\u003e?cbDown\u003c/code\u003e within your \u003ccode\u003egoshs\u003c/code\u003e deployments for similar authorization bypass gaps.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T22:01:08Z","date_published":"2026-07-28T22:01:08Z","id":"https://feed.craftedsignal.io/briefs/2026-07-goshs-auth-bypass/","summary":"An unauthenticated attacker can exploit CVE-2026-54719 in goshs versions up to 1.1.4 and goshs/v2 up to 2.1.0 to bypass file-based Access Control Lists (ACLs) and read any file under the webroot using the `?bulk` zip-download route, leading to unauthorized information disclosure.","title":"Goshs File-Based ACL Authorization Bypass via Bulk Zip Download","url":"https://feed.craftedsignal.io/briefs/2026-07-goshs-auth-bypass/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["goshs/v2 \u003c= 2.0.6"],"_cs_severities":["high"],"_cs_tags":["mitm","ssh","insecure-configuration"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe goshs application, prior to version 2.0.7, is vulnerable to a man-in-the-middle (MITM) attack when using the \u003ccode\u003e--tunnel\u003c/code\u003e or \u003ccode\u003e-t\u003c/code\u003e flag. The application opens an outbound SSH connection to \u003ccode\u003elocalhost.run:22\u003c/code\u003e with host key verification disabled via \u003ccode\u003essh.InsecureIgnoreHostKey()\u003c/code\u003e. This insecure configuration allows an attacker positioned on the network path to intercept the TCP connection, present their own SSH host key, and proxy the connection. Because \u003ccode\u003elocalhost.run\u003c/code\u003e performs TLS termination, the attacker can read and rewrite all HTTP request and response content in plaintext. This vulnerability allows for the exfiltration of sensitive data and modification of served content.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eA user executes \u003ccode\u003egoshs --tunnel\u003c/code\u003e to create a tunnel.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003etunnel.Start()\u003c/code\u003e initiates an SSH connection to \u003ccode\u003elocalhost.run:22\u003c/code\u003e with \u003ccode\u003eInsecureIgnoreHostKey()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAn attacker, positioned on the network path, intercepts the TCP connection to \u003ccode\u003elocalhost.run:22\u003c/code\u003e and responds with a malicious SSH server.\u003c/li\u003e\n\u003cli\u003eThe malicious SSH server presents a fake SSH host key, which the goshs client accepts due to the disabled host key verification.\u003c/li\u003e\n\u003cli\u003eThe attacker proxies the SSH session onward to the real \u003ccode\u003elocalhost.run:22\u003c/code\u003e to retrieve the public URL.\u003c/li\u003e\n\u003cli\u003eAll subsequent HTTP requests to the public URL are routed through the attacker's proxy.\u003c/li\u003e\n\u003cli\u003eThe attacker intercepts all HTTP requests and responses, reading sensitive data such as URLs, headers, authentication credentials, and file contents.\u003c/li\u003e\n\u003cli\u003eThe attacker can modify HTTP responses, inject malicious content, or redirect requests.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability can lead to significant data breaches and compromise of system integrity. All HTTP request and response content, including sensitive information such as URLs, headers, basic authentication credentials, file contents, and share-link tokens, can be read by the attacker. Furthermore, attackers can modify responses in transit, replacing served files, injecting malicious scripts, or substituting binaries with backdoored versions. This poses a high risk to both the confidentiality and integrity of the data being transmitted through the goshs tunnel.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to goshs version 2.0.7 or later to benefit from the fix that replaces \u003ccode\u003essh.InsecureIgnoreHostKey()\u003c/code\u003e with a TOFU host key verification mechanism.\u003c/li\u003e\n\u003cli\u003eMonitor network traffic for connections to \u003ccode\u003elocalhost.run:22\u003c/code\u003e originating from goshs processes to detect potential MITM attempts, using the provided Sigma rule.\u003c/li\u003e\n\u003cli\u003eRegularly inspect the \u003ccode\u003e~/.config/goshs/known_hosts\u003c/code\u003e file to ensure the host key for \u003ccode\u003elocalhost.run:22\u003c/code\u003e has not been tampered with (after upgrading).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-15T17:19:20Z","date_published":"2026-05-15T17:19:20Z","id":"https://feed.craftedsignal.io/briefs/2026-05-goshs-mitm/","summary":"The goshs application disables SSH host key verification when using the --tunnel flag, making it vulnerable to man-in-the-middle attacks that expose plaintext HTTP traffic.","title":"goshs SSH Tunnel Vulnerable to MITM via Insecure Host Key Handling","url":"https://feed.craftedsignal.io/briefs/2026-05-goshs-mitm/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-40188"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["goshs"],"_cs_severities":["high"],"_cs_tags":["path-traversal","sftp","cve-2026-40188"],"_cs_type":"advisory","_cs_vendors":["goshs"],"content_html":"\u003cp\u003egoshs is a SimpleHTTPServer written in Go. Versions 1.0.7 to before 2.0.0-beta.4 are vulnerable to a path traversal issue (CVE-2026-40188) within the SFTP rename command. This vulnerability arises because the application only sanitizes the source path during a rename operation, neglecting to sanitize the destination path. This oversight allows authenticated attackers with low privileges to manipulate file paths and potentially write files outside the designated SFTP root directory, leading to unauthorized file creation or modification. The vulnerability is resolved in version 2.0.0-beta.4. This vulnerability poses a risk to systems using vulnerable versions of goshs for file sharing.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains low-privilege access to the goshs server via SSH or other means.\u003c/li\u003e\n\u003cli\u003eAttacker establishes an SFTP session with the vulnerable goshs server.\u003c/li\u003e\n\u003cli\u003eAttacker identifies a file or directory within their authorized SFTP root.\u003c/li\u003e\n\u003cli\u003eAttacker crafts an SFTP rename command where the source is a legitimate file within their SFTP root.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts the destination path of the rename command to include path traversal sequences (e.g., \u0026quot;../\u0026quot;) to move outside of the intended root directory.\u003c/li\u003e\n\u003cli\u003eThe vulnerable goshs server executes the rename command using the attacker-controlled destination path without proper sanitization.\u003c/li\u003e\n\u003cli\u003eThe attacker successfully creates or overwrites files in unauthorized locations on the server's file system.\u003c/li\u003e\n\u003cli\u003eThe attacker may leverage the ability to write arbitrary files to achieve persistence by modifying system configuration files.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows attackers to bypass intended access restrictions and potentially overwrite critical system files, leading to code execution or denial-of-service. The impact is high due to the potential for privilege escalation and system compromise. While the exact number of vulnerable installations is unknown, any organization using goshs versions 1.0.7 to before 2.0.0-beta.4 are potentially at risk. Successful exploitation can lead to unauthorized data modification, or system instability.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade goshs to version 2.0.0-beta.4 or later to remediate CVE-2026-40188 as mentioned in the overview.\u003c/li\u003e\n\u003cli\u003eMonitor SFTP logs for rename operations containing path traversal sequences like \u0026quot;../\u0026quot; in the destination path. (Generic Recommendation)\u003c/li\u003e\n\u003cli\u003eImplement file integrity monitoring (FIM) on critical system directories to detect unauthorized file modifications resulting from successful exploitation. (Generic Recommendation)\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-03T12:00:00Z","date_published":"2024-01-03T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2026-04-goshs-path-traversal/","summary":"The goshs SimpleHTTPServer, from version 1.0.7 to before 2.0.0-beta.4, is vulnerable to path traversal (CVE-2026-40188) due to insufficient sanitization of the destination path in the SFTP rename command, potentially allowing attackers with low privileges to write files outside the intended root directory.","title":"goshs SimpleHTTPServer SFTP Rename Path Traversal Vulnerability (CVE-2026-40188)","url":"https://feed.craftedsignal.io/briefs/2026-04-goshs-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Goshs","version":"https://jsonfeed.org/version/1.1"}