Description
Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read database configuration and deployment SSH private keys.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
zhenorzz goploy
Default version status: unaffected
1.18.0 to < 1.18.1affected
pkg:golang/github.com/zhenorzz/goployReferences
- https://github.com/zhenorzz/goploy/commit/97a49839cc27470f4e804d985fbd2bddac085a3a ↗
- https://github.com/zhenorzz/goploy/releases/tag/v1.18.1 ↗
- https://github.com/zhenorzz/goploy/blob/v1.18.0/cmd/server/api/deploy/handler.go#L404-L418 ↗
- https://github.com/zhenorzz/goploy/security/advisories/GHSA-4g5x-hcwm-82jw ↗
- https://github.com/zhenorzz/goploy ↗
- https://www.vulncheck.com/advisories/goploy-1.18.0-before-1.18.1-symlink-following-arbitrary-file-read-via-deploy-filediff-and-deploy-filecompare ↗