Description

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`), the mode-restriction flags `--read-only`, `--upload-only`, and `--no-delete` are enforced only on the primary HTTP port. The WebDAV port is wired straight to `golang.org/x/net/webdav.Handler` with no equivalent guard, so an authenticated WebDAV client can `PUT`, `DELETE`, `MKCOL`, `MOVE`, and `COPY` despite the operator's stated intent. Version 2.1.0 patches the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-18T15:16:54.580Z",
  "pubdate": "2026-08-18T15:16:54.580Z",
  "executiveSummary": "A security vulnerability exists in goshs prior to version 2.1.0 where mode-restriction flags such as --read-only, --upload-only, and --no-delete are improperly enforced. Specifically, when the application is launched with WebDAV enabled via the -w flag, these restrictions apply exclusively to the primary HTTP port while leaving the WebDAV port unconstrained.\nThe vulnerability type is an access control bypass leading to unauthorized file modification and destruction. The impact allows authenticated WebDAV clients to execute restricted operations including PUT, DELETE, MKCOL, MOVE, and COPY, directly contradicting the operator's intended security constraints.\nAffected systems comprise goshs deployments prior to version 2.1.0 operating with WebDAV enabled. The risk implications involve the unexpected exposure of administrative file system capabilities over the network.\nAttacker capabilities require valid authentication to interact with the WebDAV service. Upon successful authentication, the attacker can bypass operational mode restrictions and perform unauthorized state-changing WebDAV methods regardless of command-line flags intended to prevent such actions.",
  "technicalDetails": "The vulnerability resides in the architectural separation between the primary HTTP server implementation and the secondary WebDAV handler in goshs prior to version 2.1.0.\nThe root cause stems from the application enforcing mode-restriction flags (--read-only, --upload-only, and --no-delete) strictly on the primary HTTP port handler logic, failing to propagate or enforce equivalent middleware or guards onto the secondary WebDAV port.\nThe vulnerable component is the WebDAV service routing configuration, which wires the WebDAV port directly to golang.org/x/net/webdav.Handler without incorporating the corresponding security constraint checks.\nNetwork exposure is present whenever goshs is initiated with the -w flag to enable WebDAV functionality, exposing the unconstrained handler over the network interface.\nAuthentication requirements dictate that the client must be authenticated to access the WebDAV endpoint, meaning exploitation is restricted to authenticated entities.\nPrivilege requirements do not necessitate elevated operating system privileges; rather, standard authentication credentials accepted by the WebDAV service are sufficient to interact with the handler.\nThe step-by-step attack flow proceeds as follows: First, the operator launches goshs with WebDAV enabled (-w) alongside restriction flags like --read-only or --upload-only, assuming these restrictions globally limit file modifications. Second, an authenticated attacker discovers or targets the WebDAV port, bypassing the primary HTTP port entirely. Third, the attacker issues restricted WebDAV methods such as PUT, DELETE, MKCOL, MOVE, or COPY against the WebDAV handler. Fourth, because golang.org/x/net/webdav.Handler lacks an equivalent guard mechanism, the handler processes the requests and modifies the underlying file system. Finally, the attacker achieves unauthorized data creation, modification, or deletion, successfully subverting the operator's stated intent."
}