goshs hat CSRF in state-changing GET routes, welches authentifizierte Dateilöschung und Verzeichnis-Erstellung ermöglicht

The primary impact of this CSRF vulnerability is the potential for unauthorized modification of the goshs server's state. An attacker could craft malicious links or embed them in websites to trick authenticated users into unknowingly triggering actions. For example, a user browsing a compromised website could inadvertently execute a ?mkdir request, creating a new directory on the goshs server. Similarly, a ?delete request could lead to unintended data loss. The blast radius is limited to the scope of actions accessible through the vulnerable GET routes, but the consequences of those actions (file creation/deletion) can be significant.

Organizations and individuals using goshs version 2.0.0-beta.4 through 2.0.0-beta.5, particularly those deploying goshs in automated environments or as part of configuration management systems, are at significant risk. Shared hosting environments where multiple users share a goshs instance are also particularly vulnerable.

• linux / server:

ps aux | grep goshs

• generic web:

curl -I https://your-goshs-server.com/?mkdir
curl -I https://your-goshs-server.com/?delete

Check access logs for unusual GET requests to / with parameters like ?mkdir or ?delete originating from unexpected IP addresses.

1. 2026-04-21Disclosure

   disclosure

1. Reserviert2026-04-15
2. Veröffentlicht2026-04-21
3. EPSS aktualisiert2026-04-29

The recommended mitigation is to immediately upgrade to goshs version 2.0.0-beta.6, which addresses the CSRF vulnerability. If upgrading is not immediately feasible, consider implementing a temporary workaround by adding CSRF protection to the vulnerable HTTP GET routes. This could involve implementing Origin or Referer header validation to ensure requests originate from trusted sources. Additionally, consider implementing a WAF rule to block suspicious GET requests containing ?mkdir or ?delete parameters. After upgrading, confirm the fix by attempting to trigger the vulnerable actions from a different browser session or incognito window to verify that the requests are now blocked.