CVE-2021-33359
📋 TL;DR
This vulnerability in gowitness versions before 2.3.6 allows unauthenticated attackers to read arbitrary files on the server by using the file:// scheme in URL parameters. Anyone running vulnerable gowitness instances is affected, particularly those exposing the service to untrusted networks.
💻 Affected Systems
- gowitness
📦 What is this software?
Gowitness by Sensepost
⚠️ Risk & Real-World Impact
Worst Case
Complete server file system compromise including sensitive configuration files, credentials, and private data disclosure
Likely Case
Unauthorized reading of sensitive files like configuration files, logs, or application data
If Mitigated
No impact if service is properly patched or isolated from untrusted networks
🎯 Exploit Status
Simple exploitation via crafted URL parameter with file:// scheme
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.6
Vendor Advisory: https://github.com/sensepost/gowitness/releases/tag/2.3.6
Restart Required: Yes
Instructions:
1. Stop gowitness service. 2. Update to version 2.3.6 or later. 3. Restart gowitness service.
🔧 Temporary Workarounds
Network isolation
linuxRestrict access to gowitness web interface to trusted networks only
iptables -A INPUT -p tcp --dport [gowitness-port] -s [trusted-network] -j ACCEPT
iptables -A INPUT -p tcp --dport [gowitness-port] -j DROP
Reverse proxy filtering
allConfigure reverse proxy to block URLs containing file:// scheme
nginx: location / { if ($request_uri ~* "file://") { return 403; } }
apache: RewriteCond %{QUERY_STRING} file:// [NC]
RewriteRule .* - [F]
🧯 If You Can't Patch
- Disable or remove gowitness service entirely
- Implement strict network access controls to limit who can reach the service
🔍 How to Verify
Check if Vulnerable:
Check gowitness version: if version < 2.3.6, it's vulnerableCheck Version:
gowitness --versionVerify Fix Applied:
Confirm version is 2.3.6 or later and test with file:// URLs returns error📡 Detection & Monitoring
Log Indicators:
- URL requests containing 'file://' in query parameters
- Access to unusual file paths via gowitness
Network Indicators:
- HTTP requests with file:// scheme in URL parameters to gowitness port
SIEM Query:
source="gowitness" AND (url="*file://*" OR uri="*file://*")