Summary
goshs contained an authentication bypass in its bulk ZIP download handler, allowing unauthenticated users to download files that should be protected by folder-level ACLs and block lists.
When the ?bulk&file= ZIP feature was used, the handler skipped effective ACL checks, exposing otherwise restricted content to anyone who could reach the HTTP endpoint.
goshs contained an authentication bypass in its bulk ZIP download handler, allowing unauthenticated users to download files that should be protected by folder-level ACLs and block lists.
When the ?bulk&file= ZIP feature was used, the handler skipped effective ACL checks, exposing otherwise restricted content to anyone who could reach the HTTP endpoint.
Affected context
This vulnerability affects goshs deployments that rely on .goshs folder ACLs and block lists to protect sensitive files or directories.
The issue is specifically tied to the bulk download functionality accessed via the ?bulk&file= query parameters, where file selection for ZIP archives bypassed the normal authorization mechanisms.
Environments that expose goshs over untrusted networks or share it with multiple users are at higher risk, especially if operators assume ACL-protected paths cannot be read without authentication.
This vulnerability affects goshs deployments that rely on .goshs folder ACLs and block lists to protect sensitive files or directories.
The issue is specifically tied to the bulk download functionality accessed via the ?bulk&file= query parameters, where file selection for ZIP archives bypassed the normal authorization mechanisms.
Environments that expose goshs over untrusted networks or share it with multiple users are at higher risk, especially if operators assume ACL-protected paths cannot be read without authentication.
Exploit preconditions
- Attack surface: HTTP interface of a goshs instance reachable by the attacker.
- Required access: Network-level access to the goshs server; no prior authentication required for the vulnerable handler.
- Trigger point: Issuing a request to the bulk download endpoint (e.g., URLs using
?bulk&file=) that references files or directories protected by.goshsACLs or block lists. - Why exploitation is possible: The bulk download handler did not invoke
findEffectiveACLorapplyCustomAuth, causing authorization decisions applied elsewhere to be skipped for ZIP-based downloads.
- Attack surface: HTTP interface of a goshs instance reachable by the attacker.
- Required access: Network-level access to the goshs server; no prior authentication required for the vulnerable handler.
- Trigger point: Issuing a request to the bulk download endpoint (e.g., URLs using
?bulk&file=) that references files or directories protected by.goshsACLs or block lists. - Why exploitation is possible: The bulk download handler did not invoke
findEffectiveACLorapplyCustomAuth, causing authorization decisions applied elsewhere to be skipped for ZIP-based downloads.
Why this happens
The underlying issue is a broken or missing authorization check on a specific code path responsible for bulk ZIP downloads.
While standard file-serving routes enforced access control via findEffectiveACL and applyCustomAuth, the bulk download handler in httpserver/updown.go omitted these checks, creating an inconsistent security model.
This maps to CWE-862 (Missing Authorization) and CWE-863 (Incorrect Authorization), where access control logic is either absent or not applied uniformly across all relevant endpoints, especially after an incomplete fix for an earlier related vulnerability.
The underlying issue is a broken or missing authorization check on a specific code path responsible for bulk ZIP downloads.
While standard file-serving routes enforced access control via findEffectiveACL and applyCustomAuth, the bulk download handler in httpserver/updown.go omitted these checks, creating an inconsistent security model.
This maps to CWE-862 (Missing Authorization) and CWE-863 (Incorrect Authorization), where access control logic is either absent or not applied uniformly across all relevant endpoints, especially after an incomplete fix for an earlier related vulnerability.
Potential impact
- Unauthenticated users can download files that operators intended to restrict via
.goshsACLs. - Exposure of sensitive configuration files, logs, or red-team artifacts stored behind folder-level protections.
- Leakage of internal operational data that may aid further attacks or reconnaissance.
- Accidental disclosure of proprietary or personal data if goshs is used as an ad-hoc file server.
- Unauthenticated users can download files that operators intended to restrict via
.goshsACLs. - Exposure of sensitive configuration files, logs, or red-team artifacts stored behind folder-level protections.
- Leakage of internal operational data that may aid further attacks or reconnaissance.
- Accidental disclosure of proprietary or personal data if goshs is used as an ad-hoc file server.
General mitigation guidance
Effective mitigation focuses on enforcing consistent authorization checks across all file-serving endpoints:
- Ensure all download paths, including bulk or convenience features (like ZIP bundling), reuse the same centralized authorization functions that enforce ACLs and block lists.
- Adopt a security-by-default approach where new handlers or features must explicitly opt into access control before serving any content.
- Design ACL evaluation as a shared, mandatory layer in the request pipeline, rather than duplicating checks within individual handlers.
- Limit exposure of goshs instances to trusted networks or reverse proxies that can provide additional authentication and path-level access control.
- Apply least-privilege principles for what content is hosted, segregating highly sensitive files from general-purpose file sharing locations.
Effective mitigation focuses on enforcing consistent authorization checks across all file-serving endpoints:
- Ensure all download paths, including bulk or convenience features (like ZIP bundling), reuse the same centralized authorization functions that enforce ACLs and block lists.
- Adopt a security-by-default approach where new handlers or features must explicitly opt into access control before serving any content.
- Design ACL evaluation as a shared, mandatory layer in the request pipeline, rather than duplicating checks within individual handlers.
- Limit exposure of goshs instances to trusted networks or reverse proxies that can provide additional authentication and path-level access control.
- Apply least-privilege principles for what content is hosted, segregating highly sensitive files from general-purpose file sharing locations.
How teams detect issues like this
Possible detection and assurance strategies include:
- Static analysis and code review: Search for HTTP handlers that read from the filesystem but do not call the central ACL/auth functions (e.g.,
findEffectiveACL,applyCustomAuth), or equivalent access control utilities. - Route-level policy checks: Maintain a checklist during development that ensures every new HTTP route documenting file access is mapped to a corresponding authorization policy.
- Automated tests: Add regression tests that attempt to access ACL-protected resources through all download mechanisms, including bulk ZIP endpoints, and verify that unauthorized requests are rejected.
- Runtime monitoring: Inspect access logs for patterns where anonymous users download large archives or files from typically restricted directories, and flag unexpected bulk-download behavior.
Possible detection and assurance strategies include:
- Static analysis and code review: Search for HTTP handlers that read from the filesystem but do not call the central ACL/auth functions (e.g.,
findEffectiveACL,applyCustomAuth), or equivalent access control utilities. - Route-level policy checks: Maintain a checklist during development that ensures every new HTTP route documenting file access is mapped to a corresponding authorization policy.
- Automated tests: Add regression tests that attempt to access ACL-protected resources through all download mechanisms, including bulk ZIP endpoints, and verify that unauthorized requests are rejected.
- Runtime monitoring: Inspect access logs for patterns where anonymous users download large archives or files from typically restricted directories, and flag unexpected bulk-download behavior.
