GHSA-3hcj-9m7p-wwm9: Go/github.com/gotify/server/v3 vulnerability
The password change endpoint (POST /current/user/password) in Gotify versions <= 2.9.1 does not require knowledge of the current password. An attacker in possession of a valid client token can set a new password for the affected user. Recovering the account requires administrator intervention or direct database access.
PoC
bash Attacker has obtained a client token No prior password knowledge required STOLENTOKEN="Cxxxxxxxxxx"
curl -X POST "http://gotify-host/current/user/password?token=${STOLENTOKEN}" \ -H "Content-Type: application/json" \ -d '{"pass":"attackercontrolsthis"}' Expected response: HTTP/1.1 200 OK
Mitigation
- Upgrade to Gotify 3.0.0, which introduces step-up authentication: changing the password now requires re-authenticating with the account password, or - Restrict access to the state-changing endpoints under /user and /current/user to trusted networks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/gotify/server/v3to a version that resolves this vulnerability.Fixed in 3.0.0 - Upgrade
Upgrade
Gotifyto a version that resolves this vulnerability.Fixed in 3.0.0 - Compensating control
Restrict access to the state-changing endpoints under /user and /current/user to trusted networks.
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs possession of a valid Gotify client token for the target user. They do not need to know the user's current password.
Which deployments are affected?
Gotify versions 2.9.1 and earlier are affected. The issue applies to deployments where an attacker can reach the password-change endpoint and has obtained a valid client token.
What is the impact if exploitation succeeds?
An attacker can set a new password for the affected user and take control of the account. Recovery requires administrator intervention or direct database access.
What can be done if an immediate upgrade is not possible?
Restrict access to state-changing endpoints under /user and /current/user to trusted networks. This reduces the opportunity for someone holding a stolen client token to reach the password-change endpoint.
What upgrade addresses the issue?
Upgrade to Gotify 3.0.0. This version requires step-up authentication with the account password before a password can be changed.