Vulnerability · Published Jul 17, 2023 · Assigned by GitHub_M
CVE-2023-37266Weak json web token (JWT) secrets in CasaOS
Critical 9.8
In plain English
A critical-severity improper authentication in CasaOS from IceWhaleTech. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.8% (higher than 94% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.
Official description
CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as `root` on CasaOS instances. This problem was addressed by improving the validation of JWTs in commit `705bf1f`. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/IceWhaleTech/CasaOS | 0.4.4 | GHSA-m5q5-8mfw-p2hr |
| Go | github.com/IceWhaleTech/CasaOS | 0.4.4 | GO-2023-1931 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| IceWhaleTech | CasaOS | < 0.4.4 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H