PT-2023-6374 · Casaos · Casaos

Thomas-Chauchefoin-Sonarsource · Publicado 2023-07-17 · Atualizado 2024-12-12 · CVE-2023-37266

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CasaOS versions prior to 0.4.4

Description Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication, allowing them to execute arbitrary commands as root on CasaOS instances. This issue is related to weaknesses in the authentication procedure, specifically in the validation of JWTs.

Recommendations For versions prior to 0.4.4, upgrade to CasaOS 0.4.4 to resolve the issue. If upgrading to 0.4.4 is not possible, temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly, to minimize the risk of exploitation.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-1391

CWE-287

Identificadores relacionados

BDU:2023-07086

CVE-2023-37266

GHSA-M5Q5-8MFW-P2HR

GO-2023-1931

Produtos afetados

Casaos

Referências · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37266.json · Exploit
• 🔥 https://sonarsource.com/blog/security-vulnerabilities-in-casaos · Exploit
• https://github.com/IceWhaleTech/CasaOS · Nota
• https://github.com/IceWhaleTech/CasaOS/security/advisories/GHSA-m5q5-8mfw-p2hr · Correção
• https://github.com/IceWhaleTech/CasaOS/commit/705bf1facbffd2ca40b159b0303132b6fdf657ad · Correção
• https://twitter.com/h3lx__/status/1714352613959827793 · Publicação no Twitter
• https://twitter.com/cyberetweet/status/1714293782362096075 · Publicação no Twitter
• https://t.me/rnetsec/19465 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-37266 · Aviso do Fabricante
• https://osv.dev/vulnerability/GO-2023-1931 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-37266 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-07086 · Nota de Segurança
• https://t.me/cvenotify/55556 · Publicação no Telegram
• https://t.me/pentestingnews/37751 · Publicação no Telegram
• https://twitter.com/jbhall56/status/1714626689148305861 · Publicação no Twitter