CVE-2026-40883: goshs SimpleHTTPServer CSRF Vulnerability

CVE-2026-40883 Overview

CVE-2026-40883 is a Cross-Site Request Forgery (CSRF) vulnerability affecting goshs, a SimpleHTTPServer written in Go. The vulnerability exists in versions 2.0.0-beta.4 to 2.0.0-beta.5 where state-changing HTTP GET routes lack proper CSRF protection. An external attacker can exploit this flaw to cause an already authenticated browser to trigger destructive actions such as file deletion (?delete) and directory creation (?mkdir) because goshs relies solely on HTTP basic authentication and performs no CSRF token validation, Origin header checks, or Referer validation for those routes.

Critical Impact

Authenticated users can be tricked into performing unintended destructive file system operations, including file deletion and unauthorized directory creation, through malicious cross-site requests.

Affected Products

• goshs version 2.0.0-beta.4
• goshs version 2.0.0-beta.5

Discovery Timeline

• 2026-04-21 - CVE CVE-2026-40883 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-40883

Vulnerability Analysis

This vulnerability represents a classic CSRF weakness (CWE-352) in web application design. The goshs server implements state-changing operations through HTTP GET requests, which violates RESTful security principles. GET requests should be idempotent and safe, meaning they should not modify server-side state. By implementing destructive operations like file deletion via GET parameters, the application becomes vulnerable to CSRF attacks.

The authentication mechanism in goshs relies exclusively on HTTP Basic Authentication, which browsers automatically include in subsequent requests once authenticated. This creates a scenario where any request originating from the authenticated browser—regardless of its origin—will be treated as legitimate by the server.

Root Cause

The root cause of this vulnerability is twofold:

1. Improper HTTP method usage: State-changing operations (?delete, ?mkdir) are implemented as GET requests rather than POST, PUT, or DELETE methods that would require explicit form submissions or API calls.

2. Missing CSRF protections: The application does not implement any form of CSRF mitigation such as anti-CSRF tokens, Same-Site cookie attributes, Origin header validation, or Referer header verification.

These design decisions allow an attacker to craft malicious links or embed hidden requests in third-party websites that, when visited by an authenticated user, will execute destructive operations on the goshs server.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker can exploit this vulnerability by:

1. Crafting a malicious URL containing the destructive operation (e.g., http://target-goshs-server/?delete=/path/to/important/file)
2. Embedding this URL in an email, forum post, or malicious webpage (via <img> tags, iframes, or links)
3. Tricking an authenticated goshs user into visiting the malicious content
4. The browser automatically sends the request with the user's HTTP Basic Auth credentials
5. The goshs server executes the destructive operation without verifying the request's legitimacy

The attack could be as simple as embedding an image tag: when the authenticated user's browser attempts to load the "image," it actually sends a file deletion request to the goshs server.

Detection Methods for CVE-2026-40883

Indicators of Compromise

• Unexpected file deletions or directory creations in goshs-managed directories
• Access logs showing ?delete or ?mkdir requests with Referer headers pointing to external domains
• User reports of files being deleted without their direct action

Detection Strategies

• Monitor goshs access logs for state-changing GET requests with external or missing Referer headers
• Implement alerting on unusual patterns of ?delete or ?mkdir operations
• Review access logs for requests originating from unusual user-agent strings or IP addresses following authenticated sessions

Monitoring Recommendations

• Enable detailed access logging on goshs servers to capture Referer and Origin headers
• Deploy web application firewall (WAF) rules to detect and block suspicious cross-origin requests to state-changing endpoints
• Implement file integrity monitoring on directories served by goshs to detect unauthorized modifications

How to Mitigate CVE-2026-40883

Immediate Actions Required

• Upgrade goshs to version 2.0.0-beta.6 or later immediately
• Audit goshs access logs to identify any potential exploitation attempts
• Review file system for unexpected deletions or directory creations during the exposure window
• Consider temporarily disabling the goshs service if immediate upgrade is not possible

Patch Information

The vulnerability is fixed in goshs version 2.0.0-beta.6. Users should upgrade to this version or later to receive the security fix. For detailed information about the fix, refer to the GitHub Security Advisory.

Workarounds

• Place goshs behind a reverse proxy that implements CSRF protection
• Restrict network access to goshs servers to trusted networks only
• Implement additional authentication layers at the network level (VPN, IP allowlisting)
• Disable or restrict access to the ?delete and ?mkdir functionality if not required

# Example: Restrict goshs access to localhost only
# Run goshs with localhost binding to prevent external access
goshs -i 127.0.0.1 -p 8000

# Example: Use iptables to restrict access to trusted IPs
iptables -A INPUT -p tcp --dport 8000 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP