Vulnerability · Published Jul 17, 2023 · Assigned by GitHub_M
CVE-2023-37265Incorrect identification of source IP addresses in CasaOS
Critical 9.8
In plain English
A critical-severity missing authentication in CasaOS-Gateway from IceWhaleTech. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 7.4% (higher than 94% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.
Official description
CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification an unauthenticated attackers can execute arbitrary commands as `root` on CasaOS instances. The problem was addressed by improving the detection of client IP addresses in `391dd7f`. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/IceWhaleTech/CasaOS-Gateway | 0.4.4 | GHSA-vjh7-5r6x-xh6g |
| Go | github.com/IceWhaleTech/CasaOS-Gateway | 0.4.4 | GO-2023-1932 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| IceWhaleTech | CasaOS-Gateway | < 0.4.4 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/IceWhaleTech/CasaOS-Gateway/security/advisories/GHSA-vjh7-5r6x-xh6g x_refsource_CONFIRM
- https://github.com/IceWhaleTech/CasaOS-Gateway/commit/391dd7f0f239020c46bf057cfa25f82031fc15f7 x_refsource_MISC
- https://www.sonarsource.com/blog/security-vulnerabilities-in-casaos x_refsource_MISC