PT-2023-25869 · Casaos · Casaos

Thomas-Chauchefoin-Sonarsource · Publicado 2023-07-17 · Atualizado 2025-04-07 · CVE-2023-37265

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CasaOS versions prior to 0.4.4

Description CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification, an unauthenticated attacker can execute arbitrary commands as root on CasaOS instances. The problem was addressed by improving the detection of client IP addresses.

Recommendations For versions prior to 0.4.4, upgrade to CasaOS 0.4.4. If upgrading to 0.4.4 is not possible, temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.

Exploit

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

CWE-348

Identificadores relacionados

CVE-2023-37265

GHSA-VJH7-5R6X-XH6G

GO-2023-1932

Produtos afetados

Casaos

Referências · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37265.json · Exploit
• 🔥 https://sonarsource.com/blog/security-vulnerabilities-in-casaos · Exploit
• https://github.com/IceWhaleTech/CasaOS-Gateway/security/advisories/GHSA-vjh7-5r6x-xh6g · Aviso do Fabricante, Correção
• https://github.com/IceWhaleTech/CasaOS-Gateway · Nota
• https://github.com/IceWhaleTech/CasaOS-Gateway/commit/391dd7f0f239020c46bf057cfa25f82031fc15f7 · Correção
• https://twitter.com/h3lx__/status/1714352613959827793 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-37265 · Nota de Segurança
• https://t.me/rnetsec/19465 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-37265 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-vjh7-5r6x-xh6g · Aviso do Fabricante
• https://t.me/cibsecurity/66861 · Publicação no Telegram
• https://pkg.go.dev/vuln/GO-2023-1932 · Nota
• https://t.me/defcon_news/118976 · Publicação no Telegram
• https://osv.dev/vulnerability/GO-2023-1932 · Aviso do Fabricante
• https://twitter.com/cyberetweet/status/1714293782362096075 · Publicação no Twitter