gohttpserver upload unpacking flaw lets attackers write arbitrary files
Anyone can plant files on a file-sharing server and take over the system!
Summary
The /upload endpoint of gohttpserver does not check paths when unpacking ZIP archives, so an unauthenticated attacker can write files to any location on the server. Installations with upload enabled are affected, and overwriting system files can lead to remote code execution.
Affected when
- upload feature enabled (--upload flag or upload: true in .ghs.yml)
What to do
No fixed version is named in the sources. The affected versions run through v1.3.0, so check that the server runs a version newer than v1.3.0 and read the project's advisory. Until then, keep upload disabled.
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen