Description

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, `ShareHandler` reads the share token's `DownloadLimit` under `RLock`, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same `Downloaded`/`DownloadLimit` snapshot, all pass the check, and all are served — exceeding the operator's intended cap. Version 2.1.0 patches the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-18T15:16:54.733Z",
  "pubdate": "2026-08-18T15:16:54.733Z",
  "executiveSummary": "A race condition vulnerability exists in goshs prior to version 2.1.0, specifically within the ShareHandler component. The flaw arises from improper synchronization when enforcing download limits on shared files.\nThe vulnerability allows malicious or concurrent users to bypass configured download limits by issuing simultaneous requests. Because the application reads the current download count and limit under a read lock, releases the lock during file transmission, and only re-acquires it afterward, multiple concurrent requests can capture the same snapshot state, successfully passing validation.\nThe impact includes resource exhaustion, unauthorized data exfiltration, and circumvention of administrative intent regarding file sharing constraints.\nThe affected product is goshs prior to version 2.1.0. Exploitation requires network access to the HTTP server and the ability to issue concurrent requests against a shared file endpoint possessing a restricted DownloadLimit.",
  "technicalDetails": "The root cause of the vulnerability is a TOCTOU (Time-Of-Check to Time-Of-Use) race condition stemming from fragmented locking semantics within the ShareHandler component of goshs.\nDuring the request lifecycle for a shared resource, ShareHandler acquires an RLock to inspect the share token's Downloaded counter against the configured DownloadLimit. Once the check succeeds, the read lock is prematurely released to facilitate the serving of the file payload over the network. After the file transmission completes, the handler re-acquires the lock to increment the Downloaded counter.\nBecause the lock is released while the file is actively being served, concurrent requests arriving within this temporal window read an identical snapshot of the Downloaded and DownloadLimit states. Consequently, all concurrent validation checks evaluate to true, bypassing the intended access control threshold.\nThe vulnerable component is the ShareHandler function handling token-based file distribution in goshs versions prior to 2.1.0. The vulnerability is network-exploitable assuming the attacker possesses a valid share token and network connectivity to the SimpleHTTPServer instance.\nAuthentication requirements depend on the exposure of the share token, but no elevated privileges are required to exploit the race condition beyond the ability to request the shared resource. Attack payload behavior involves flooding the endpoint with parallel HTTP GET requests to maximize the race window and exceed the administrative quota."
}