Vulnerability · Published Mar 6, 2024 · Assigned by GitHub_M
CVE-2024-24765CasaOS-UserService allows unauthorized access to any file
High 7.5
In plain English
A high-severity information exposure in CasaOS-UserService from IceWhaleTech. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
CasaOS-UserService provides user management functionalities to CasaOS. Prior to version 0.4.7, path filtering of the URL for user avatar image files was not strict, making it possible to get any file on the system. This could allow an unauthorized actor to access, for example, the CasaOS user database, and possibly obtain system root privileges. Version 0.4.7 fixes this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/IceWhaleTech/CasaOS-UserService | 0.4.7 | GHSA-h5gf-cmm8-cg7c |
| Go | github.com/IceWhaleTech/CasaOS-UserService | 0.4.7 | GO-2024-2616 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| IceWhaleTech | CasaOS-UserService | < 0.4.7 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-h5gf-cmm8-cg7c x_refsource_CONFIRM
- https://github.com/IceWhaleTech/CasaOS-UserService/commit/3f4558e23c0a9958f9a0e20aabc64aa8fd51840e x_refsource_MISC
- https://github.com/IceWhaleTech/CasaOS-UserService/releases/tag/v0.4.7 x_refsource_MISC