6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-rhf7-wvw3-vjvm

GHSA-rhf7-wvw3-vjvm: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS

Summary

The PUT upload handler (httpserver/updown.go) lacks the CSRF token validation that was added to the POST upload handler during the GHSA-jrq5-hg6x-j6g3 fix. Combined with the unconditional Access-Control-Allow-Origin: * on the OPTIONS preflight handler (httpserver/server.go), any website can write arbitrary files to a goshs instance through the victim's browser — bypassing network isolation (e.g. localhost, internal network).

Details

Root Cause 1 — Missing CSRF on PUT (httpserver/updown.go:19)

When GHSA-jrq5-hg6x-j6g3 was fixed (commit e3c3d37), checkCSRF() was added to the POST upload() function (line 78) but not to the PUT put() function directly above it in the same file. This means PUT requests are accepted without any CSRF token.

// POST — protected 
func (fs *FileServer) upload(w http.ResponseWriter, req *http.Request) {
    if !fs.checkCSRF(w, req) { return }
    // ...
}

// PUT — unprotected 
func (fs *FileServer) put(w http.ResponseWriter, req *http.Request) {
    // No checkCSRF call
    // ...
}

Root Cause 2 — Wildcard CORS (httpserver/server.go:126)

The OPTIONS handler unconditionally returns permissive CORS headers:

w.Header().Set("Access-Control-Allow-Origin", "*")
w.Header().Set("Access-Control-Allow-Methods", "POST, PUT, OPTIONS")
w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization")

This allows any website's JavaScript to pass the browser's CORS preflight check and send PUT requests to the goshs server.

PoC

poc.zip

Please extract the uploaded compressed file before proceeding

bash poc.sh <img width="543" height="376" alt="스크린샷 2026-04-17 오후 11 08 13" src="https://github.com/user-attachments/assets/a695cbc8-133e-4e80-a2f5-9fe9fd36b569" />

Miggo Vulnerability Database

→

GHSA-rhf7-wvw3-vjvm

GHSA-rhf7-wvw3-vjvm:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/patrickhener/goshs/v2	go	< 2.0.2	2.0.2
github.com/patrickhener/goshs	go	<= 1.1.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic Cross-Site Request Forgery (CSRF) that leads to arbitrary file write, made possible by two combined weaknesses. The root cause is the FileServer.put function in httpserver/updown.go, which processed file uploads without requiring a CSRF token. This meant the server could not verify if a file upload request was intentionally sent by the user. The vulnerability's exploitability was amplified by a second flaw in the FileServer.SetupMux function in httpserver/server.go. This function configured a request handler that responded to CORS preflight (OPTIONS) requests with Access-Control-Allow-Origin: *, effectively disabling the browser's Same-Origin Policy for the goshs server. An attacker could therefore host a malicious script on any website which, when visited by a victim, would forge and send a PUT request to the victim's local or internal goshs instance, allowing the attacker to write or overwrite any file in the server's webroot.

Vulnerable functions

FileServer.put

httpserver/updown.go

This function handles file uploads via HTTP PUT requests. Prior to the patch, it did not perform any Cross-Site Request Forgery (CSRF) validation. This omission allowed an attacker to craft a malicious webpage that, when visited by a victim, would cause the victim's browser to send a PUT request to the goshs server to create or overwrite files. The server would accept this request as it had no way to distinguish it from a legitimate, user-initiated action.

FileServer.SetupMux

httpserver/server.go

This function configures the HTTP request router. A part of this function sets up an anonymous handler for OPTIONS preflight requests that unconditionally responds with `Access-Control-Allow-Origin: *`. This permissive Cross-Origin Resource Sharing (CORS) policy is the second component of the vulnerability. It instructs browsers to permit scripts running on any website to send requests to the goshs server, defeating the browser's Same-Origin Policy. This allowed the CSRF attack from the `put` function to be triggered from any malicious website.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

6.5

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-rhf7-wvw3-vjvm: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS

Summary

Details

PoC

GHSA-rhf7-wvw3-vjvm:

6.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Basic Information

Basic Information

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

6.5

6.5

GHSA-rhf7-wvw3-vjvm: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS

Summary

Details

PoC

Impact

6.5

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-rhf7-wvw3-vjvm: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS

Summary

Details

PoC

GHSA-rhf7-wvw3-vjvm:

6.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

6.5

6.5

GHSA-rhf7-wvw3-vjvm: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS

Summary

Details

PoC

Impact

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI