{"id":"GHSA-rhf7-wvw3-vjvm","summary":"goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS","details":"### Summary\nThe PUT upload handler (`httpserver/updown.go`) lacks the CSRF token validation that was added to the POST upload handler during the GHSA-jrq5-hg6x-j6g3 fix. Combined with the unconditional `Access-Control-Allow-Origin: *` on the OPTIONS preflight handler (`httpserver/server.go`), any website can write arbitrary files to a goshs instance through the victim's browser — bypassing network isolation (e.g. localhost, internal network).\n\n### Details\n**Root Cause 1 — Missing CSRF on PUT** (`httpserver/updown.go:19`)\n\nWhen GHSA-jrq5-hg6x-j6g3 was fixed (commit `e3c3d37`), `checkCSRF()` was added to the POST `upload()` function (line 78) but not to the PUT `put()` function directly above it in the same file. This means PUT requests are accepted without any CSRF token.\n\n```go\n// POST — protected \nfunc (fs *FileServer) upload(w http.ResponseWriter, req *http.Request) {\n    if !fs.checkCSRF(w, req) { return }\n    // ...\n}\n\n// PUT — unprotected \nfunc (fs *FileServer) put(w http.ResponseWriter, req *http.Request) {\n    // No checkCSRF call\n    // ...\n}\n```\n\n**Root Cause 2 — Wildcard CORS** (`httpserver/server.go:126`)\n\nThe OPTIONS handler unconditionally returns permissive CORS headers:\n\n```go\nw.Header().Set(\"Access-Control-Allow-Origin\", \"*\")\nw.Header().Set(\"Access-Control-Allow-Methods\", \"POST, PUT, OPTIONS\")\nw.Header().Set(\"Access-Control-Allow-Headers\", \"Content-Type, Authorization\")\n```\n\nThis allows any website's JavaScript to pass the browser's CORS preflight check and send PUT requests to the goshs server.\n\n### PoC\n[poc.zip](https://github.com/user-attachments/files/26828829/poc.zip)\n\nPlease extract the uploaded compressed file before proceeding\n\n1. bash poc.sh\n\u003cimg width=\"543\" height=\"376\" alt=\"스크린샷 2026-04-17 오후 11 08 13\" src=\"https://github.com/user-attachments/assets/a695cbc8-133e-4e80-a2f5-9fe9fd36b569\" /\u003e\n\n\n\n\n### Impact\n- Arbitrary file write to the goshs webroot from any website the victim visits\n- File overwrite — existing files can be silently replaced","aliases":["CVE-2026-42091","GO-2026-5625"],"modified":"2026-06-25T23:11:18.539302367Z","published":"2026-04-23T14:28:14Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-04-23T14:28:14Z","nvd_published_at":"2026-05-04T18:16:31Z","cwe_ids":["CWE-352"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/patrickhener/goshs/security/advisories/GHSA-rhf7-wvw3-vjvm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42091"},{"type":"WEB","url":"https://github.com/patrickhener/goshs/commit/0e715b94e10c3d1aa552276000f15f104dee2f32"},{"type":"PACKAGE","url":"https://github.com/patrickhener/goshs"},{"type":"WEB","url":"https://github.com/patrickhener/goshs/releases/tag/v2.0.2"}],"affected":[{"package":{"name":"github.com/patrickhener/goshs/v2","ecosystem":"Go","purl":"pkg:golang/github.com/patrickhener/goshs/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-rhf7-wvw3-vjvm/GHSA-rhf7-wvw3-vjvm.json"}},{"package":{"name":"github.com/patrickhener/goshs","ecosystem":"Go","purl":"pkg:golang/github.com/patrickhener/goshs"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.1.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-rhf7-wvw3-vjvm/GHSA-rhf7-wvw3-vjvm.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"}]}