goshs WebSocket Command Execution Vulnerability

A command execution vulnerability has been identified in goshs, a SimpleHTTPServer written in Go. This issue affects versions 0.3.4 through 1.0.4. When goshs is run without arguments, the 'dispatchReadPump' function fails to validate the presence of the '-c' option, allowing anyone to execute arbitrary commands on the server via WebSockets.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the server where goshs is running.

Reproduction

The vulnerability can be reproduced by sending a WebSocket request to a goshs server instance running a vulnerable version without any command-line arguments. The 'dispatchReadPump' function will process the request and execute the command on the server.

Remediation

Users can upgrade to goshs version 1.0.5 or later to address this vulnerability.