CyberRota Analysis
AI-GeneratedThe vulnerability exists in the goshs SimpleHTTPServer prior to version 2.1.0, where WebDAV functionality allows authenticated clients to perform unrestricted file operations (PUT, DELETE, MKCOL, MOVE, COPY) on the WebDAV port, bypassing intended access controls. This could lead to unauthorized data manipulation or deletion, posing significant risks to data integrity and availability. Organizations using goshs with WebDAV enabled should prioritize upgrading to version 2.1.0 to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`), the mode-restriction flags `--read-only`, `--upload-only`, and `--no-delete` are enforced only on the primary HTTP port. The WebDAV port is wired straight to `golang.org/x/net/webdav.Handler` with no equivalent guard, so an authenticated WebDAV client can `PUT`, `DELETE`, `MKCOL`, `MOVE`, and `COPY` despite the operator's stated intent. Version 2.1.0 patches the issue.