Threat database

Gophish versions through 0.12.1 have stored and reflected cross-site scripting (XSS) vulnerabilities. These flaws allow attackers who control or intercept SMTP server error messages to inject malicious scripts. The injected scripts can execute when administrators view campaign results or send test emails, potentially leading to theft of API keys.

Gophish versions 0.11.0 through 0.12.1 have a server-side request forgery (SSRF) vulnerability that allows authenticated low-privileged users to send POST requests to /api/import/site and access loopback and private network hosts. This vulnerability enables attackers to submit internal URLs that bypass the default dialer deny list, potentially allowing them to read service responses and enumerate internal hosts and ports via error messages. The vulnerability has a medium severity with a CVSS score of 4.3.

Gophish versions through 0.12.1 have an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages, and sending profiles by supplying another user's sequential ID in certain API POST requests. This can lead to unauthorized reassignment of objects and exposure of recipient lists.

Gophish versions through 0.12.1 have a rate limit bypass vulnerability that allows unauthenticated attackers to evade login throttling by spoofing X-Forwarded-For or X-Real-IP headers. This enables attackers to perform unlimited password guessing and credential stuffing attacks against the /login endpoint.

Gophish versions up to 0.12.1 have a timing discrepancy vulnerability in the AdminServer.Login function. This flaw allows unauthenticated attackers to enumerate valid usernames by measuring differences in login response times. By submitting usernames to the POST /login endpoint, attackers can detect bcrypt comparison delays indicative of existing accounts. This information can aid attackers in focusing password guessing or credential stuffing attacks. The vulnerability has a medium severity with a CVSS score of 3.7. No patch or remediation details are provided in the available data.

Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the browser context.

Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords for the configured IMAP and SMTP servers.