{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/patrickhener/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["goshs \u003c= 2.1.3","goshs \u003c= 1.1.4"],"_cs_severities":["critical"],"_cs_tags":["webdav","vulnerability","file-deletion","data-destruction","server","golang"],"_cs_type":"advisory","_cs_vendors":["patrickhener"],"content_html":"\u003cp\u003eA critical vulnerability, tracked as CVE-2026-64863, has been discovered in the \u003ccode\u003egoshs\u003c/code\u003e WebDAV server (versions up to 2.1.3 and 1.1.4). The \u003ccode\u003e--no-delete\u003c/code\u003e command-line flag, intended to prevent file deletion and overwriting, is ineffective against the WebDAV \u003ccode\u003eMOVE\u003c/code\u003e HTTP method. This logical flaw allows a remote attacker to bypass a configured security control, enabling unauthorized deletion of source files or overwriting of existing destination files, even when the server operator believes deletion is disabled. The issue stems from the server's \u003ccode\u003ewdGuard\u003c/code\u003e handler, which incorrectly classifies \u003ccode\u003eMOVE\u003c/code\u003e as a write-only operation, thus failing to apply the \u003ccode\u003efs.NoDelete\u003c/code\u003e check to it. This oversight defeats the security intent of the \u003ccode\u003e--no-delete\u003c/code\u003e flag, jeopardizing data integrity for systems using \u003ccode\u003egoshs\u003c/code\u003e to serve files with deletion restrictions.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a \u003ccode\u003egoshs\u003c/code\u003e server running with WebDAV enabled and the \u003ccode\u003e--no-delete\u003c/code\u003e flag configured (e.g., \u003ccode\u003egoshs --webdav --no-delete\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker attempts to \u003ccode\u003eDELETE\u003c/code\u003e a file, which is correctly blocked by the server, returning an HTTP 403 Forbidden status, confirming the \u003ccode\u003e--no-delete\u003c/code\u003e flag is active for the \u003ccode\u003eDELETE\u003c/code\u003e verb.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts an HTTP \u003ccode\u003eMOVE\u003c/code\u003e request targeting a sensitive file (e.g., \u003ccode\u003e/secret.txt\u003c/code\u003e) with a \u003ccode\u003eDestination\u003c/code\u003e header pointing to a new path (e.g., \u003ccode\u003e/gone.txt\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe server processes the \u003ccode\u003eMOVE\u003c/code\u003e request, effectively deleting \u003ccode\u003e/secret.txt\u003c/code\u003e from its original location and moving its content to \u003ccode\u003e/gone.txt\u003c/code\u003e, bypassing the \u003ccode\u003e--no-delete\u003c/code\u003e control.\u003c/li\u003e\n\u003cli\u003eAlternatively, the attacker crafts an HTTP \u003ccode\u003eMOVE\u003c/code\u003e request with an \u003ccode\u003eOverwrite: T\u003c/code\u003e header, targeting a source file (e.g., \u003ccode\u003e/gone.txt\u003c/code\u003e) and a destination path that corresponds to an existing, sensitive file (e.g., \u003ccode\u003e/victim.txt\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe server processes this \u003ccode\u003eMOVE\u003c/code\u003e request, first invoking \u003ccode\u003eRemoveAll\u003c/code\u003e on the existing \u003ccode\u003e/victim.txt\u003c/code\u003e and then moving the content of \u003ccode\u003e/gone.txt\u003c/code\u003e to \u003ccode\u003e/victim.txt\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThis results in the original content of \u003ccode\u003e/victim.txt\u003c/code\u003e being destroyed and replaced with the attacker-controlled content, allowing data destruction or overwriting, despite the \u003ccode\u003e--no-delete\u003c/code\u003e flag.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe impact of CVE-2026-64863 is significant for \u003ccode\u003egoshs\u003c/code\u003e deployments where file integrity and prevention of deletion/overwriting are paramount. If an operator sets up \u003ccode\u003egoshs\u003c/code\u003e with \u003ccode\u003e--no-delete\u003c/code\u003e to protect critical data, such as archived artifacts or confidential documents, any authenticated (or unauthenticated, if no ACLs are in place) WebDAV client can exploit this flaw. This allows an attacker to rename confidential files away, effectively deleting them from their expected location, or worse, overwrite existing sensitive files with arbitrary content. This directly violates the intended security posture, leading to data loss, data corruption, or the unavailability of critical information, undermining the trust in the configured security controls.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePatch CVE-2026-64863\u003c/strong\u003e: Update \u003ccode\u003egoshs\u003c/code\u003e to a patched version immediately. Monitor the official GitHub repository for releases that address this vulnerability.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDeploy the Sigma rule in this brief\u003c/strong\u003e: Implement the provided Sigma rule into your SIEM to detect suspicious WebDAV \u003ccode\u003eMOVE\u003c/code\u003e requests, particularly those including the \u003ccode\u003eOverwrite: T\u003c/code\u003e header.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eEnable webserver logging\u003c/strong\u003e: Ensure comprehensive logging for your \u003ccode\u003egoshs\u003c/code\u003e instances, including HTTP method, URI, status codes, and request headers (specifically \u003ccode\u003eOverwrite\u003c/code\u003e). This is crucial for the provided Sigma rule.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T22:04:16Z","date_published":"2026-07-28T22:04:16Z","id":"https://feed.craftedsignal.io/briefs/2026-07-goshs-webdav-move-bypass/","summary":"A critical vulnerability (CVE-2026-64863) in the goshs WebDAV server, affecting versions up to 2.1.3, allows an attacker to bypass the `--no-delete` security flag using the `MOVE` HTTP method, leading to unauthorized deletion of source files or overwriting of existing destination files, impacting data integrity.","title":"Goshs WebDAV MOVE Method Bypasses No-Delete Flag","url":"https://feed.craftedsignal.io/briefs/2026-07-goshs-webdav-move-bypass/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["goshs (\u003c= 1.1.4)","goshs/v2 (\u003c= 2.1.0)"],"_cs_severities":["high"],"_cs_tags":["authorization-bypass","webserver","vulnerability","cve","information-disclosure"],"_cs_type":"advisory","_cs_vendors":["patrickhener"],"content_html":"\u003cp\u003eA high-severity authorization bypass vulnerability, tracked as CVE-2026-54719, has been identified in \u003ccode\u003egoshs\u003c/code\u003e (versions \u0026lt;= 1.1.4) and \u003ccode\u003egoshs/v2\u003c/code\u003e (versions \u0026lt;= 2.1.0) which allows unauthenticated attackers to read arbitrary files. This flaw is a residual vulnerability from a previous fix (GHSA-wvhv-qcqf-f3cx) which addressed ACL bypasses on state-changing routes but failed to cover the \u003ccode\u003e?bulk\u003c/code\u003e zip-download endpoint. The \u003ccode\u003ebulkDownload\u003c/code\u003e function, invoked by requests containing \u003ccode\u003e?bulk\u003c/code\u003e and \u003ccode\u003e?file=\u003c/code\u003e parameters, retrieves file contents as a ZIP archive without performing the necessary \u003ccode\u003e.goshs\u003c/code\u003e ACL checks or honoring per-file block lists. This critical oversight enables any unauthenticated network attacker to bypass folder-level and file-level access controls, leading to unauthorized disclosure of confidential information from files located under the webroot. The vulnerability does not affect write or delete operations, limiting the impact to confidentiality only.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker identifies a vulnerable \u003ccode\u003egoshs\u003c/code\u003e instance exposed on the network.\u003c/li\u003e\n\u003cli\u003eThe attacker attempts to access a known protected file directly (e.g., \u003ccode\u003eGET /protected/secret.txt\u003c/code\u003e), which is correctly denied with a 401 Unauthorized response by the server's standard authorization flow.\u003c/li\u003e\n\u003cli\u003eThe attacker then crafts a malicious HTTP GET request targeting the \u003ccode\u003e?bulk\u003c/code\u003e zip-download route, appending the \u003ccode\u003e?file=\u003c/code\u003e parameter with the path to the desired protected file (e.g., \u003ccode\u003eGET /?bulk\u0026amp;file=/protected/secret.txt\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003egoshs\u003c/code\u003e server receives this request and routes it to the \u003ccode\u003ebulkDownload\u003c/code\u003e function, bypassing the normal authorization gates.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ebulkDownload\u003c/code\u003e function processes the \u003ccode\u003e?file=\u003c/code\u003e parameter, retrieves the content of \u003ccode\u003e/protected/secret.txt\u003c/code\u003e, and streams it back to the attacker within a ZIP archive.\u003c/li\u003e\n\u003cli\u003eThe attacker extracts the ZIP archive to obtain the contents of the confidential file, completely circumventing the \u003ccode\u003e.goshs\u003c/code\u003e ACL protections and any per-file block lists.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-54719 leads to unauthorized information disclosure, specifically the confidentiality of any file stored under the \u003ccode\u003egoshs\u003c/code\u003e webroot that relies solely on \u003ccode\u003e.goshs\u003c/code\u003e ACLs for protection. While a server-wide basic authentication mechanism (\u003ccode\u003e-b\u003c/code\u003e flag) would still gate the \u003ccode\u003e?bulk\u003c/code\u003e route, deployments relying on per-folder \u003ccode\u003e.goshs\u003c/code\u003e ACLs are vulnerable. Attackers can exfiltrate sensitive data such as configuration files, user data, or intellectual property without any authentication, posing a significant risk to data privacy and security. The vulnerability does not allow for data modification or deletion.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetects CVE-2026-54719 Exploitation - Goshs bulk download ACL bypass\u003c/code\u003e to your SIEM to identify attempts to exploit this vulnerability.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for \u003ccode\u003eGET\u003c/code\u003e requests to \u003ccode\u003e/?bulk\u003c/code\u003e containing the \u003ccode\u003efile=\u003c/code\u003e parameter, as these indicate potential exploitation attempts.\u003c/li\u003e\n\u003cli\u003eApply the latest security patches from \u003ccode\u003egoshs\u003c/code\u003e developers immediately, which should enforce \u003ccode\u003e.goshs\u003c/code\u003e ACLs within the \u003ccode\u003ebulkDownload\u003c/code\u003e function or route \u003ccode\u003e?bulk\u003c/code\u003e requests through the same authorization gate as normal read paths.\u003c/li\u003e\n\u003cli\u003eConduct an audit of other alternate read routes such as \u003ccode\u003e?cbDown\u003c/code\u003e within your \u003ccode\u003egoshs\u003c/code\u003e deployments for similar authorization bypass gaps.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T22:01:08Z","date_published":"2026-07-28T22:01:08Z","id":"https://feed.craftedsignal.io/briefs/2026-07-goshs-auth-bypass/","summary":"An unauthenticated attacker can exploit CVE-2026-54719 in goshs versions up to 1.1.4 and goshs/v2 up to 2.1.0 to bypass file-based Access Control Lists (ACLs) and read any file under the webroot using the `?bulk` zip-download route, leading to unauthorized information disclosure.","title":"Goshs File-Based ACL Authorization Bypass via Bulk Zip Download","url":"https://feed.craftedsignal.io/briefs/2026-07-goshs-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Patrickhener","version":"https://jsonfeed.org/version/1.1"}