| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/patrickhener/goshs | ≥ 0.3.4, < 1.0.5 | 1.0.5 |
It seems that when running goshs without arguments it is possible for anyone to execute commands on the server. This was tested on version 1.0.4 of goshs. The command function was introduced in version 0.3.4.
It seems that the function dispatchReadPump does not checks the option cli -c, thus allowing anyone to execute arbitrary command through the use of websockets.
Used websocat for the POC:
echo -e '{"type": "command", "content": "id"}' |./websocat 'ws://192.168.1.11:8000/?ws' -t
The vulnerability will only impacts goshs server on vulnerable versions.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free