2.7 KiB
gokapi — triage (pin f0rc3/gokapi:v1.9.6)
Template: NO gate field. First boot seeds config.json (internal auth, single user admin, Encryption Level 0 = E2E off). v1.9.x has NO multi-user
system (added in v2.0.0) and NO File Requests (added v2.2.0).
Notices (10)
- 3c22-5j5m-4jq7 stored XSS via SVG hotlink — REAL (hotlinks exist in 1.9.6). high. Login: an uploader = only the admin. Reachable: self-XSS only on our template (no second account); low practical risk.
- hcff-qv74-7hr4 login CSRF — REAL (code present). medium. Needs the attacker to know an account's password; only account is admin → not usable.
- qwc6-vc2v-2ggj API unbounded body DoS — REAL (API present). medium. Login: admin/API key. Low.
- NOT-A-FINDING (feature absent in 1.9.6 or single-user):
- 45vh-rpc8-hxpp File Request MaxSize bypass — File Requests added in v2.2.0.
- j6jp-78w8-34x6 file-replace permission escalation — v2 permission system.
- m2hx-wjxc-9fp4 short-lived token escalation — v2 users/short-lived tokens (v2.2.0).
- q658-hfpg-35qc API-key perms kept after rank demotion — user ranks are v2.
- c36c-7pc2-f2ph uploadStatus leaks other users' file ids — single user only.
- 4xg4-54hm-9j77 API-key friendly-name XSS — advisory: "If you are the only authenticated user ... not affected".
- 95rc-wc32-gm53 filename XSS — needs E2E encryption (ours Level 0) + a second user.
Fix
Smallest fixing the 3 real: v2.2.4 (3c22/hcff → 2.2.3, qwc6 → 2.2.4). TARGET f0rc3/gokapi:v2.2.4 (Docker Hub tag exists, v prefix as our pin).
Same main: NO (1 → 2). No 1.x release after v1.9.6.
Breaking (8 releases read, v2.0.0..v2.2.4): v2.0.0 user management, NO downgrade, "Requires v1.9.6 as base", config.json must be writable;
our first-boot seed is pinned to ConfigVersion 21 (must be re-captured); v2.2.0 DOCKER_NONROOT deprecated, chunks >=5 MB, API FileList output
changed, log deletion admin-only; v2.2.1 trusted proxies / GOKAPI_USE_CLOUDFLARE env (we strip XFF); v2.2.2 docker subnets auto-trusted;
v2.2.3 SVG hotlinks removed on startup.
Lane: BIG_STEP. Quick lane: NO_FIX (no 1.x fix).
Options (no fix inside main 1)
Blocks today: single-admin seed, E2E off — none of the 3 real items is usable by a stranger.
- Option A: leave on 1.9.6 and record the residual (admin-only self-XSS/DoS) — cost: nothing; 1.9.6 is unmaintained (last 1.x Dec 2024).
- Option B: BIG_STEP to v2.2.4 with a re-captured seed config — cost: bench migration + new seed + live share/download test.
- If you do nothing: no stranger-reachable exposure from these notices; the app ages on an unmaintained branch. Classifier note: gokapi advisories after v2.0.0 describe multi-user / File Request features — range-only matching over-reports on 1.x.