PT-2024-22347 · Casaos · Casaos

Drdark1999 · Published 2024-04-01 · Updated 2025-06-24 · CVE-2024-28232

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CasaOS versions prior to 0.4.7

Description The Casa OS Login page has a username enumeration issue. An attacker can enumerate usernames by observing the application's response. If the username is incorrect, the application returns "User does not exist" with return code "10006", while if the password is incorrect, it returns "User does not exist or password is invalid" with return code "10013". This allows an attacker to determine if a username exists without knowing the password.

Recommendations For versions prior to 0.4.7, update to version 0.4.7 or later to resolve the issue. As a temporary workaround, consider implementing a single error message, such as "Username/Password is Incorrect!", with a single return code, to prevent attackers from enumerating usernames based on the application's response.

Exploit

Fix

Weakness Enumeration

CWE-204

Related Identifiers

CVE-2024-28232

GHSA-HCW2-2R9C-GC6P

GO-2024-2668

Affected Products

Casaos

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28232.json · Exploit
• https://github.com/IceWhaleTech/CasaOS-UserService/commit/dd927fe1c805e53790f73cfe10c7a4ded3bc5bdb · Patch
• https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-hcw2-2r9c-gc6p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28232 · Security Note
• https://osv.dev/vulnerability/CVE-2024-28232 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2668 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hcw2-2r9c-gc6p · Vendor Advisory
• https://github.com/IceWhaleTech/CasaOS-UserService · Note
• https://t.me/cvenotify/75377 · Telegram Post
• https://t.me/cvenotify/75474 · Telegram Post
• https://t.me/cvenotify/126552 · Telegram Post