PT-2024-20545 · Casaos · Casaos

Drdark1999 · Published 2024-03-06 · Updated 2024-03-18 · CVE-2024-24767

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CasaOS versions 0.4.4.3 through 0.4.6

Description The CasaOS web application lacks control over login attempts, allowing attackers to perform password brute force attacks and gain full access to the server with super user-level access.

Recommendations For versions 0.4.4.3 through 0.4.6, update to version 0.4.7 to resolve the issue. As a temporary workaround, consider restricting access to the login functionality until a patch is applied. Avoid using the web application for critical operations until the issue is resolved.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2024-24767

GHSA-C69X-5XMW-V44X

GO-2024-2614

Affected Products

Casaos

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24767.json · Exploit
• https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-c69x-5xmw-v44x · Vendor Advisory
• https://github.com/IceWhaleTech/CasaOS-UserService/commit/62006f61b55951048dbace4ebd9e483274838699 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-24767 · Security Note
• https://osv.dev/vulnerability/GHSA-c69x-5xmw-v44x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-24767 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2614 · Vendor Advisory
• https://github.com/IceWhaleTech/CasaOS-UserService · Note
• https://github.com/IceWhaleTech/CasaOS-UserService/releases/tag/v0.4.7 · Note
• https://pkg.go.dev/vuln/GO-2024-2614 · Note
• https://t.me/cvenotify/73162 · Telegram Post