CVE-2023-37265

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-37265
CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification an unauthenticated attackers can execute arbitrary commands as `root` on CasaOS instances. The problem was addressed by improving the detection of client IP addresses in `391dd7f`. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/IceWhaleTech/CasaOS-Gateway/commit/391dd7f0f239020c46bf057cfa25f82031fc15f7 Patch
https://github.com/IceWhaleTech/CasaOS-Gateway/security/advisories/GHSA-vjh7-5r6x-xh6g Patch Third Party Advisory
https://www.sonarsource.com/blog/security-vulnerabilities-in-casaos
https://github.com/IceWhaleTech/CasaOS-Gateway/commit/391dd7f0f239020c46bf057cfa25f82031fc15f7 Patch
https://github.com/IceWhaleTech/CasaOS-Gateway/security/advisories/GHSA-vjh7-5r6x-xh6g Patch Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:icewhale:casaos:*:*:*:*:*:*:*:*
cpe:2.3:o:icewhale:casaos:0.4.4:alpha1:*:*:*:*:*:*
cpe:2.3:o:icewhale:casaos:0.4.4:alpha2:*:*:*:*:*:*
cpe:2.3:o:icewhale:casaos:0.4.4:alpha3:*:*:*:*:*:*
cpe:2.3:o:icewhale:casaos:0.4.4:alpha4:*:*:*:*:*:*
cpe:2.3:o:icewhale:casaos:0.4.4:alpha5:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:icewhale:casaos-gateway:*:*:*:*:*:*:*:*
cpe:2.3:a:icewhale:casaos-gateway:0.4.4:alpha1:*:*:*:*:*:*
History

12 Dec 2024, 21:15

Type Values Removed Values Added
Summary (en) CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification an unauthenticated attackers can execute arbitrary commands as `root` on CasaOS instances. The problem was addressed by improving the detection of client IP addresses in `391dd7f`. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly. (en) CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification an unauthenticated attackers can execute arbitrary commands as `root` on CasaOS instances. The problem was addressed by improving the detection of client IP addresses in `391dd7f`. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.
References
  • () https://www.sonarsource.com/blog/security-vulnerabilities-in-casaos -

21 Nov 2024, 08:11

Type Values Removed Values Added
References () https://github.com/IceWhaleTech/CasaOS-Gateway/commit/391dd7f0f239020c46bf057cfa25f82031fc15f7 - Patch () https://github.com/IceWhaleTech/CasaOS-Gateway/commit/391dd7f0f239020c46bf057cfa25f82031fc15f7 - Patch
References () https://github.com/IceWhaleTech/CasaOS-Gateway/security/advisories/GHSA-vjh7-5r6x-xh6g - Patch, Third Party Advisory () https://github.com/IceWhaleTech/CasaOS-Gateway/security/advisories/GHSA-vjh7-5r6x-xh6g - Patch, Third Party Advisory

31 Jul 2023, 13:05

Type Values Removed Values Added
CPE cpe:2.3:o:icewale:casaos:0.4.4:alpha2:*:*:*:*:*:*
cpe:2.3:o:icewale:casaos:*:*:*:*:*:*:*:*
cpe:2.3:o:icewale:casaos:0.4.4:alpha5:*:*:*:*:*:*
cpe:2.3:o:icewale:casaos:0.4.4:alpha4:*:*:*:*:*:*
cpe:2.3:o:icewale:casaos:0.4.4:alpha3:*:*:*:*:*:*
cpe:2.3:o:icewale:casaos:0.4.4:alpha1:*:*:*:*:*:*		 cpe:2.3:o:icewhale:casaos:0.4.4:alpha2:*:*:*:*:*:*
cpe:2.3:o:icewhale:casaos:*:*:*:*:*:*:*:*
cpe:2.3:o:icewhale:casaos:0.4.4:alpha1:*:*:*:*:*:*
cpe:2.3:o:icewhale:casaos:0.4.4:alpha3:*:*:*:*:*:*
cpe:2.3:o:icewhale:casaos:0.4.4:alpha4:*:*:*:*:*:*
cpe:2.3:o:icewhale:casaos:0.4.4:alpha5:*:*:*:*:*:*

27 Jul 2023, 03:48

Type Values Removed Values Added
References (MISC) https://github.com/IceWhaleTech/CasaOS-Gateway/commit/391dd7f0f239020c46bf057cfa25f82031fc15f7 - (MISC) https://github.com/IceWhaleTech/CasaOS-Gateway/commit/391dd7f0f239020c46bf057cfa25f82031fc15f7 - Patch
References (MISC) https://github.com/IceWhaleTech/CasaOS-Gateway/security/advisories/GHSA-vjh7-5r6x-xh6g - (MISC) https://github.com/IceWhaleTech/CasaOS-Gateway/security/advisories/GHSA-vjh7-5r6x-xh6g - Patch, Third Party Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
CPE cpe:2.3:o:icewale:casaos:0.4.4:alpha2:*:*:*:*:*:*
cpe:2.3:o:icewale:casaos:*:*:*:*:*:*:*:*
cpe:2.3:o:icewale:casaos:0.4.4:alpha5:*:*:*:*:*:*
cpe:2.3:a:icewhale:casaos-gateway:*:*:*:*:*:*:*:*
cpe:2.3:a:icewhale:casaos-gateway:0.4.4:alpha1:*:*:*:*:*:*
cpe:2.3:o:icewale:casaos:0.4.4:alpha4:*:*:*:*:*:*
cpe:2.3:o:icewale:casaos:0.4.4:alpha3:*:*:*:*:*:*
cpe:2.3:o:icewale:casaos:0.4.4:alpha1:*:*:*:*:*:*

17 Jul 2023, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-07-17 21:15

Updated : 2024-12-12 21:15

NVD link : CVE-2023-37265

Mitre link : CVE-2023-37265

CVE.ORG link : CVE-2023-37265

JSON object : View

Products Affected

icewhale

  • casaos
  • casaos-gateway
CWE
CWE-306

Missing Authentication for Critical Function