Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
go-gost/gost
master @ c305f93
3
Fixes
5
CVEs
CRITICAL
Peak severity
Highlights
Auth Bypass: 3 prior fixes. Scrutinize any change in this area.
cmd/gost/tls.go: most-fixed (1 issue). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The configuration Web API endpoints lacked mandatory basic authentication middleware, allowing unauthorized actors to perform modifications (POST, PUT, DELETE) on the running proxy configurations. Developers must ensure all administrative route groups enforce strict authentication before dispatching requests.
Auth Bypass: Service listeners lacked proper admission control filters on the Accept path, failing to enforce configured client IP allow/deny lists. Developers must consistently wrap connection listeners with admission controls to prevent unauthorized client IP access.
Auth Bypass: Self-signed TLS certificates generated dynamically did not populate the Subject Alternative Name (SAN) DNSNames and used outdated private key serialization. This can cause strict TLS clients to reject the certificates or bypass validation if improperly handled.