goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. This vulnerability is fixed in 2.0.0-beta.6.

Affected: Go: github.com/patrickhener/goshs, Go: github.com/patrickhener/goshs/v2

### Summary goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with `-b ':pass'` together with `-sftp`, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. I reproduced this on the latest release `v2.0.0-beta.5`.

### Details The help text explicitly documents empty usernames as valid authentication input:

- `options/options.go:264-266` says `Use basic authentication (user:pass - user can be empty)`

The SFTP sanity check only requires that either `-b` or `--sftp-keyfile` is present:

```go if opts.SFTP && (opts.BasicAuth == "" && opts.SFTPKeyFile == "") { logger.Fatal("When using SFTP you need to either specify an authorized keyfile using -sfk or username and password using -b") } ```

That parsing logic then splits `-b ':pass'` into an empty username and a non-empty password:

```go auth := strings.SplitN(opts.BasicAuth, ":", 2) opts.Username = auth[0] opts.Password = auth[1] ```

But the SFTP server only installs a password handler if both the username and password are non-empty:

```go if s.Username != "" && s.Password != "" { sshServer.PasswordHandler = func(ctx ssh.Context, password string) bool { return ctx.User() == s.Username && password == s.Password } } ```

With `-b ':pass'`, that condition is false, so no password aut…