patrickhener/goshs · Security
goshs route not protected, allows command execution
- GHSA ID
- GHSA-rwj2-w85g-5cmm
- CVE ID
- CVE-2025-46816
- Severity
- critical
- Published
- Updated
- CVSS
- 9.4 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
- CVSS v3
- 9.4 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Description
Summary
It seems that when running goshs without arguments it is possible for anyone to execute commands on the server. This was tested on version 1.0.4 of goshs. The command function was introduced in version 0.3.4.
Details
It seems that the function dispatchReadPump does not checks the option cli -c, thus allowing anyone to execute arbitrary command through the use of websockets.
PoC
Used websocat for the POC:
echo -e '{"type": "command", "content": "id"}' |./websocat 'ws://192.168.1.11:8000/?ws' -t
Impact
The vulnerability will only impacts goshs server on vulnerable versions.
CWEs
- CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
- CWE-284 · Improper Access Control