PT-2023-6374 · Casaos · Casaos

Thomas-Chauchefoin-Sonarsource · Published 2023-07-17 · Updated 2024-12-12 · CVE-2023-37266

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CasaOS versions prior to 0.4.4

Description Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication, allowing them to execute arbitrary commands as root on CasaOS instances. This issue is related to weaknesses in the authentication procedure, specifically in the validation of JWTs.

Recommendations For versions prior to 0.4.4, upgrade to CasaOS 0.4.4 to resolve the issue. If upgrading to 0.4.4 is not possible, temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly, to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-1391

CWE-287

Related Identifiers

BDU:2023-07086

CVE-2023-37266

GHSA-M5Q5-8MFW-P2HR

GO-2023-1931

Affected Products

Casaos

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37266.json · Exploit
• 🔥 https://sonarsource.com/blog/security-vulnerabilities-in-casaos · Exploit
• https://github.com/IceWhaleTech/CasaOS/security/advisories/GHSA-m5q5-8mfw-p2hr · Patch
• https://github.com/IceWhaleTech/CasaOS/commit/705bf1facbffd2ca40b159b0303132b6fdf657ad · Patch
• https://osv.dev/vulnerability/CVE-2023-37266 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1931 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37266 · Security Note
• https://bdu.fstec.ru/vul/2023-07086 · Security Note
• https://osv.dev/vulnerability/GHSA-m5q5-8mfw-p2hr · Vendor Advisory
• https://github.com/IceWhaleTech/CasaOS · Note
• https://twitter.com/h3lx__/status/1714352613959827793 · Twitter Post
• https://twitter.com/cyberetweet/status/1714293782362096075 · Twitter Post
• https://t.me/rnetsec/19465 · Telegram Post
• https://t.me/cvenotify/55556 · Telegram Post
• https://t.me/pentestingnews/37751 · Telegram Post