PT-2023-25869 · Casaos · Casaos

Thomas-Chauchefoin-Sonarsource · Published 2023-07-17 · Updated 2025-04-07 · CVE-2023-37265

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CasaOS versions prior to 0.4.4

Description CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification, an unauthenticated attacker can execute arbitrary commands as root on CasaOS instances. The problem was addressed by improving the detection of client IP addresses.

Recommendations For versions prior to 0.4.4, upgrade to CasaOS 0.4.4. If upgrading to 0.4.4 is not possible, temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

CWE-348

Related Identifiers

CVE-2023-37265

GHSA-VJH7-5R6X-XH6G

GO-2023-1932

Affected Products

Casaos

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37265.json · Exploit
• 🔥 https://sonarsource.com/blog/security-vulnerabilities-in-casaos · Exploit
• https://github.com/IceWhaleTech/CasaOS-Gateway/commit/391dd7f0f239020c46bf057cfa25f82031fc15f7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-37265 · Security Note
• https://osv.dev/vulnerability/CVE-2023-37265 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vjh7-5r6x-xh6g · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1932 · Vendor Advisory
• https://github.com/IceWhaleTech/CasaOS-Gateway/security/advisories/GHSA-vjh7-5r6x-xh6g · Vendor Advisory, Patch
• https://github.com/IceWhaleTech/CasaOS-Gateway · Note
• https://twitter.com/h3lx__/status/1714352613959827793 · Twitter Post
• https://t.me/rnetsec/19465 · Telegram Post
• https://t.me/cibsecurity/66861 · Telegram Post
• https://pkg.go.dev/vuln/GO-2023-1932 · Note
• https://t.me/defcon_news/118976 · Telegram Post
• https://twitter.com/cyberetweet/status/1714293782362096075 · Twitter Post