PT-2024-20544 · Unknown · Casaos-Userservice

Drdark1999 · Published 2024-03-06 · Updated 2025-05-28 · CVE-2024-24766

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CasaOS-UserService versions 0.4.4.3 through 0.4.6

Description The CasaOS Login page has a username enumeration issue, allowing an attacker to enumerate CasaOS usernames using the application response. If the username is incorrect, the application gives the error User does not exist. If the password is incorrect, the application gives the error Invalid password. This issue can be exploited to enumerate usernames.

Recommendations For versions 0.4.4.3 through 0.4.6, update to version 0.4.7 to fix the issue. As a temporary workaround, consider implementing a single error message, such as Username/Password is Incorrect!!!, with a single success code to prevent username enumeration.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-204

CWE-203

Related Identifiers

CVE-2024-24766

GHSA-C967-2652-GFJM

GHSA-HCW2-2R9C-GC6P

GO-2024-2615

Affected Products

Casaos-Userservice

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24766.json · Exploit
• 🔥 https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-hcw2-2r9c-gc6p · Exploit
• https://github.com/IceWhaleTech/CasaOS-UserService/commit/c75063d7ca5800948e9c09c0a6efe9809b5d39f7 · Patch
• https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-c967-2652-gfjm · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c967-2652-gfjm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-24766 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24766 · Security Note
• https://osv.dev/vulnerability/GHSA-hcw2-2r9c-gc6p · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2615 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28232 · Security Note
• https://github.com/IceWhaleTech/CasaOS-UserService · Note
• https://github.com/IceWhaleTech/CasaOS-UserService/commit/dd927fe1c805e53790f73cfe10c7a4ded3bc5bdb · Note
• https://github.com/IceWhaleTech/CasaOS-UserService/releases/tag/v0.4.7 · Note
• https://t.me/cvenotify/73163 · Telegram Post
• https://t.me/cvenotify/123922 · Telegram Post