Listen to this Post
The vulnerability exists in goshs versions prior to v2.0.7 when the `–tunnel` (-t) flag is used. The `tunnel.Start()` function creates an SSH client to `localhost.run:22` with HostKeyCallback: ssh.InsecureIgnoreHostKey(). According to Go’s documentation, this function “should not be used for production code” because it accepts any host key presented by the server. An on-path attacker (compromised router, malicious Wi-Fi, ARP/DNS spoofing, BGP hijack, malicious VPN) intercepts the operator’s outbound TCP connection to `localhost.run:22` and replies with their own SSH server bearing an attacker-generated host key. Since the callback returns `nil` unconditionally, the handshake completes and the client believes it is talking to the genuine localhost.run. The attacker then proxies the SSH session onward to the real localhost.run:22, capturing the genuine public URL (e.g., https://.lhr.life`) so the operator sees normal output. Because `localhost.run` terminates TLS at their end, the HTTP traffic over the SSH tunnel is plaintext. Consequently, every HTTP request (URLs, headers, `Authorization` basic-auth credentials, bodies) and every response sent through the tunnel is fully readable and modifiable by the attacker. The attacker can rewrite responses to inject scripts, replace files, or strip security headers. There is no fallback verification such asssh.FixedHostKey, reading a `known_hosts` file, or TOFU pinning. Every invocation of `goshs --tunnel` before v2.0.7 is equally vulnerable.
<h2 style="color: blue;">dailycve form:</h2>
Platform: goshs
Version: before v2.0.7
Vulnerability: SSH MITM via InsecureIgnoreHostKey
Severity: Critical
date: 2026-05-16
<h2 style="color: blue;">Prediction: Patched 2025-01-10</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
Check vulnerable tunnel.go grep -A5 "HostKeyCallback" tunnel/tunnel.go Simulate MITM with socat (attacker) socat TCP-LISTEN:22,fork TCP:localhost.run:22 & Then redirect operator's traffic (ARP spoof / iptables) Operator connects; attacker reads plaintext HTTP tcpdump -i eth0 -A 'tcp port 22 and (http or "GET" or "POST")'
<h2 style="color: blue;">Exploit:</h2>
1. Attacker positions between operator and localhost.run (e.g.,arpspoof,dnsspoof).socat TCP:localhost.run:22 TCP-LISTEN:2222,fork
2. Run fake SSH server: `python -m twisted.conch.scripts.ckeygen -t rsa -f hostkey ; twistd conch --hostkey hostkey --port 22 --auth nopass`
<h2 style="color: blue;">3. Proxy to real localhost.run:</h2>goshs –tunnel`, attacker accepts key, relays session, captures URL.
4. When operator runs
5. All HTTP traffic (basic auth, file uploads, tokens) logged: `strings captured.pcap`
Protection from this CVE:
- Upgrade to goshs v2.0.7 or later.
- If patched, verify known_hosts fingerprint: `ssh-keyscan localhost.run 2>/dev/null | ssh-keygen -l -f -` and compare with startup warning.
- Delete `~/.config/goshs/known_hosts` only after confirming legitimate key rotation.
- Avoid using `–tunnel` over untrusted networks; force TLS inside tunnel (e.g., HTTPS reverse proxy).
- Monitor for unexpected host key mismatch errors: `FATAL tunnel: ssh: host key mismatch for localhost.run:22`
Impact:
- Confidentiality (High): Attacker reads all HTTP requests (URLs, headers, Basic Auth Authorization, file contents, share-link tokens, ?goshs-info JSON dump) and responses.
- Integrity (High): Attacker modifies responses in-flight – injects malicious scripts into HTML, replaces downloadable binaries with backdoored versions, redirects requests, strips Set-Cookie flags.
- Availability: Not directly affected.
- Credential Theft: Captured basic-auth credentials grant authenticated access to upload, share-link, catcher, clipboard, and CLI endpoints. If goshs runs credential listeners (SMB/LDAP/SMTP), NTLM hashes and SMTP messages are also exposed.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
