Goshs - CraftedSignal Threat Feed

goshs SimpleHTTPServer SFTP Authentication Bypass Vulnerability (CVE-2026-40884)

hello@craftedsignal.io — Wed, 24 Jan 2024 12:00:00 +0000

The goshs SimpleHTTPServer, a utility written in Go, is susceptible to an SFTP authentication bypass vulnerability (CVE-2026-40884) in versions prior to 2.0.0-beta.6. This flaw arises when the server is launched using the -b ':pass' argument in conjunction with the -sftp flag. This specific configuration prevents the application from properly initializing an SFTP password handler. Consequently, a remote, unauthenticated attacker can establish a connection to the SFTP service and gain unauthorized access to files stored on the server. This vulnerability poses a significant risk to data confidentiality and integrity. Organizations using affected versions of goshs should upgrade to version 2.0.0-beta.6 or later immediately.

Attack Chain

Attacker identifies a vulnerable goshs server running a version prior to 2.0.0-beta.6 with SFTP enabled using -sftp and the vulnerable authentication configuration -b ':pass'.
Attacker establishes a network connection to the server's SFTP port (typically port 22, or a custom-configured port).
The attacker initiates an SFTP connection without providing any username or password, exploiting the missing password handler.
The vulnerable goshs server accepts the connection without authentication due to the configuration error.
The attacker is granted access to the file system served by the goshs server via SFTP.
The attacker navigates the file system, identifies sensitive files, and downloads them.
Attacker exfiltrates the stolen data from the network.
The attacker may use the compromised server as a pivot point for further attacks within the network.

Impact

Successful exploitation of CVE-2026-40884 allows an unauthenticated attacker to access sensitive files stored on the vulnerable goshs server. The impact can range from information disclosure to complete compromise of the server and potential lateral movement within the network. Given the CVSS v3.1 base score of 9.8, this vulnerability represents a critical risk. The number of affected systems depends on the adoption rate of goshs and the specific configurations used.

Recommendation

Upgrade goshs to version 2.0.0-beta.6 or later to patch CVE-2026-40884.
Review goshs server configurations and remove the vulnerable -b ':pass' configuration.
Monitor network connections to SFTP ports (default 22) for suspicious activity originating from unknown sources. Use the "Detect Suspicious SFTP Connection" Sigma rule provided below.
Implement network segmentation to limit the blast radius of a potential compromise.

goshs SimpleHTTPServer SFTP Rename Path Traversal Vulnerability (CVE-2026-40188)

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

goshs is a SimpleHTTPServer written in Go. Versions 1.0.7 to before 2.0.0-beta.4 are vulnerable to a path traversal issue (CVE-2026-40188) within the SFTP rename command. This vulnerability arises because the application only sanitizes the source path during a rename operation, neglecting to sanitize the destination path. This oversight allows authenticated attackers with low privileges to manipulate file paths and potentially write files outside the designated SFTP root directory, leading to unauthorized file creation or modification. The vulnerability is resolved in version 2.0.0-beta.4. This vulnerability poses a risk to systems using vulnerable versions of goshs for file sharing.

Attack Chain

Attacker gains low-privilege access to the goshs server via SSH or other means.
Attacker establishes an SFTP session with the vulnerable goshs server.
Attacker identifies a file or directory within their authorized SFTP root.
Attacker crafts an SFTP rename command where the source is a legitimate file within their SFTP root.
The attacker crafts the destination path of the rename command to include path traversal sequences (e.g., "../") to move outside of the intended root directory.
The vulnerable goshs server executes the rename command using the attacker-controlled destination path without proper sanitization.
The attacker successfully creates or overwrites files in unauthorized locations on the server's file system.
The attacker may leverage the ability to write arbitrary files to achieve persistence by modifying system configuration files.

Impact

Successful exploitation of this vulnerability allows attackers to bypass intended access restrictions and potentially overwrite critical system files, leading to code execution or denial-of-service. The impact is high due to the potential for privilege escalation and system compromise. While the exact number of vulnerable installations is unknown, any organization using goshs versions 1.0.7 to before 2.0.0-beta.4 are potentially at risk. Successful exploitation can lead to unauthorized data modification, or system instability.

Recommendation

Upgrade goshs to version 2.0.0-beta.4 or later to remediate CVE-2026-40188 as mentioned in the overview.
Monitor SFTP logs for rename operations containing path traversal sequences like "../" in the destination path. (Generic Recommendation)
Implement file integrity monitoring (FIM) on critical system directories to detect unauthorized file modifications resulting from successful exploitation. (Generic Recommendation)