Gophish v0.11.0
Gophish just got better.
We're excited to announce the release of Gophish v0.11.0. This release includes important security fixes, adds some minor features, and fixes some bugs.
Security Fixes
This release addresses multiple security issues that were identified and reported by the community. As always, we encourage sending in security reports via our security policy, and are appreciative of all the work that went in to finding and reporting these vulnerabilities.
The following vulnerabilities were fixed in this latest release:
Server-side Request Forgery (SSRF)
Reported by: Marcus Nilsson of usd AG Reported by: @dunderhay in #1908
An authenticated user could use certain features of Gophish to make inbound connections to the local network. The most critical of these is via the Landing Page import feature, which could be used to make arbitrary upstream web requests.
Since importing local webpages, or otherwise making local network connections (e.g. for SMTP/IMAP servers, webhook URLs, etc.) is an expected use case for Gophish we've decided to implement an opt-in allowlist. By default, we block access only to known IP addresses commonly associated with cloud metadata services, but it is now possible to explicitly set the configuration variable in the section of config.json to a list of allowed internal addresses.