| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| github.com/patrickhener/goshs | ≥ 0.3.4, < 1.0.5 | 1.0.5 |
It seems that when running goshs without arguments it is possible for anyone to execute commands on the server. This was tested on version 1.0.4 of goshs. The command function was introduced in version 0.3.4.
It seems that the function dispatchReadPump does not checks the option cli -c, thus allowing anyone to execute arbitrary command through the use of websockets.
Used websocat for the POC:
echo -e '{"type": "command", "content": "id"}' |./websocat 'ws://192.168.1.11:8000/?ws' -t
The vulnerability will only impacts goshs server on vulnerable versions.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン