Summary
goshs incorrectly treats the WebDAV MOVE method as write-only and fails to honor the --no-delete restriction for delete-like operations.
A WebDAV client can use MOVE requests with Overwrite: T to delete or overwrite existing files, even when deletion should be disabled, leading to unauthorized file modification or loss.
goshs incorrectly treats the WebDAV MOVE method as write-only and fails to honor the --no-delete restriction for delete-like operations.
A WebDAV client can use MOVE requests with Overwrite: T to delete or overwrite existing files, even when deletion should be disabled, leading to unauthorized file modification or loss.
Affected context
This vulnerability appears in goshs instances that:
- Expose the WebDAV interface for file operations
- Rely on the
--no-deleteoption (or similar configuration) to prevent file deletion - Run versions prior to 2.1.4 where MOVE is treated as a purely write operation
In these configurations, operators may assume files cannot be deleted, while WebDAV MOVE can still be used to remove or overwrite content.
This vulnerability appears in goshs instances that:
- Expose the WebDAV interface for file operations
- Rely on the
--no-deleteoption (or similar configuration) to prevent file deletion - Run versions prior to 2.1.4 where MOVE is treated as a purely write operation
In these configurations, operators may assume files cannot be deleted, while WebDAV MOVE can still be used to remove or overwrite content.
Exploit preconditions
- Attack surface: HTTP/WebDAV endpoint exposed by goshs
- Required access: Ability to send authenticated or unauthenticated HTTP/WebDAV requests, depending on how goshs is configured (e.g., network reachability, optional auth)
- Trigger point: Issuing a WebDAV
MOVErequest withOverwrite: Ttargeting existing files or paths protected by--no-delete - Why exploitation is possible: The wdGuard logic classifies MOVE as a write-only method and fails to tie it to deletion semantics, so delete restrictions are not applied to MOVE operations.
- Attack surface: HTTP/WebDAV endpoint exposed by goshs
- Required access: Ability to send authenticated or unauthenticated HTTP/WebDAV requests, depending on how goshs is configured (e.g., network reachability, optional auth)
- Trigger point: Issuing a WebDAV
MOVErequest withOverwrite: Ttargeting existing files or paths protected by--no-delete - Why exploitation is possible: The wdGuard logic classifies MOVE as a write-only method and fails to tie it to deletion semantics, so delete restrictions are not applied to MOVE operations.
Why this happens
The core issue is improper authorization and method handling for WebDAV operations, mapping to CWE-284: Improper Access Control.
The wdGuard component enforces deletion restrictions based on HTTP methods, but MOVE is incorrectly treated as a simple write, ignoring its inherent ability to remove or overwrite existing resources.
As a result, the access control policy (--no-delete) is inconsistently applied: direct DELETE may be blocked, while a semantically equivalent MOVE operation is permitted, creating a gap between intended and actual protections.
The core issue is improper authorization and method handling for WebDAV operations, mapping to CWE-284: Improper Access Control.
The wdGuard component enforces deletion restrictions based on HTTP methods, but MOVE is incorrectly treated as a simple write, ignoring its inherent ability to remove or overwrite existing resources.
As a result, the access control policy (--no-delete) is inconsistently applied: direct DELETE may be blocked, while a semantically equivalent MOVE operation is permitted, creating a gap between intended and actual protections.
Potential impact
- Attackers could delete existing files by moving them over other resources with
Overwrite: T - Attackers could overwrite existing files, potentially replacing legitimate content with malicious payloads
- Loss of critical data stored on the server due to unintended deletions
- Disruption of red-team or development workflows relying on goshs as a trusted file server
- Facilitation of further compromise if overwritten files are scripts, binaries, or configuration artifacts executed by other systems
- Attackers could delete existing files by moving them over other resources with
Overwrite: T - Attackers could overwrite existing files, potentially replacing legitimate content with malicious payloads
- Loss of critical data stored on the server due to unintended deletions
- Disruption of red-team or development workflows relying on goshs as a trusted file server
- Facilitation of further compromise if overwritten files are scripts, binaries, or configuration artifacts executed by other systems
General mitigation guidance
Effective mitigation focuses on enforcing consistent access control across all methods that can change or remove resources:
- Treat WebDAV MOVE, COPY, and similar methods according to their full semantics, applying any delete or overwrite restrictions uniformly.
- Centralize authorization checks so policy decisions are based on the effect of an operation (e.g., "can this remove or overwrite a file?") rather than only the HTTP verb.
- Where possible, configure goshs (or any file server) to operate with minimal privileges on the filesystem, isolating served content from critical system paths.
- Use strong authentication and network-level controls (VPNs, firewalls, IP allowlists) to limit who can reach the WebDAV interface.
- Prefer secure-by-default configurations where destructive operations are disabled unless explicitly required, and ensure that any "no delete" or "read-only" modes are comprehensively tested across all supported file operations.
Effective mitigation focuses on enforcing consistent access control across all methods that can change or remove resources:
- Treat WebDAV MOVE, COPY, and similar methods according to their full semantics, applying any delete or overwrite restrictions uniformly.
- Centralize authorization checks so policy decisions are based on the effect of an operation (e.g., "can this remove or overwrite a file?") rather than only the HTTP verb.
- Where possible, configure goshs (or any file server) to operate with minimal privileges on the filesystem, isolating served content from critical system paths.
- Use strong authentication and network-level controls (VPNs, firewalls, IP allowlists) to limit who can reach the WebDAV interface.
- Prefer secure-by-default configurations where destructive operations are disabled unless explicitly required, and ensure that any "no delete" or "read-only" modes are comprehensively tested across all supported file operations.
How teams detect issues like this
Detection strategies typically focus on both code-level and operational signals:
- Static analysis / code review:
- Look for authorization logic that keys off HTTP methods without considering semantic equivalence (e.g., protecting DELETE but not WebDAV MOVE or COPY).
- Flag controllers or handlers where "write-only" classification is applied without analyzing whether operations can remove or overwrite resources.
- Review guard functions (such as wdGuard) to ensure configuration flags like
--no-deleteare enforced consistently. - Runtime monitoring:
- Enable access logging that records WebDAV methods (MOVE, COPY, PROPFIND, etc.) and request headers such as
Overwrite. - Monitor for unexpected MOVE requests targeting sensitive or supposedly protected paths.
- Use file integrity monitoring on directories served by goshs to detect unauthorized deletions or modifications.
- Security testing:
- Incorporate WebDAV method fuzzing into penetration tests and CI security checks to confirm that "no-delete" or "read-only" modes cannot be bypassed via alternate verbs.
Detection strategies typically focus on both code-level and operational signals:
- Static analysis / code review:
- Look for authorization logic that keys off HTTP methods without considering semantic equivalence (e.g., protecting DELETE but not WebDAV MOVE or COPY).
- Flag controllers or handlers where "write-only" classification is applied without analyzing whether operations can remove or overwrite resources.
- Review guard functions (such as wdGuard) to ensure configuration flags like
--no-deleteare enforced consistently. - Runtime monitoring:
- Enable access logging that records WebDAV methods (MOVE, COPY, PROPFIND, etc.) and request headers such as
Overwrite. - Monitor for unexpected MOVE requests targeting sensitive or supposedly protected paths.
- Use file integrity monitoring on directories served by goshs to detect unauthorized deletions or modifications.
- Security testing:
- Incorporate WebDAV method fuzzing into penetration tests and CI security checks to confirm that "no-delete" or "read-only" modes cannot be bypassed via alternate verbs.
