GitHub Advisoryadvisory · Go
GHSA-m5q5-8mfw-p2hr CasaOS contains weak JWT secrets
CRITICAL
Official page ↗
- Aliases
- CVE-2023-37266
- Ecosystem
- Go
- Packages
- github.com/IceWhaleTech/CasaOS
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-1391, CWE-287
- Reviewed
- 2023-07-17
Affected packages
• Go github.com/IceWhaleTech/CasaOS: < 0.4.4 → fixed in 0.4.4
Description
Impact
Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as `root` on CasaOS instances.
Patches
The problem was addressed by improving the validation of JWTs in 705bf1f. This patch is part of CasaOS 0.4.4.
Workarounds
Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.
References
• 705bf1f
• https://www.sonarsource.com/blog/security-vulnerabilities-in-casaos/
Related
Alias · CVE (1)
- CVE-2023-37266 CasaOS is an open-source Personal Cloud system. vulnerability
References
- https://github.com/IceWhaleTech/CasaOS/security/advisories/GHSA-m5q5-8mfw-p2hr web
- https://nvd.nist.gov/vuln/detail/CVE-2023-37266 advisory
- https://github.com/IceWhaleTech/CasaOS/commit/705bf1facbffd2ca40b159b0303132b6fdf657ad web
- https://github.com/IceWhaleTech/CasaOS package
- https://pkg.go.dev/vuln/GO-2023-1931 web
- https://www.sonarsource.com/blog/security-vulnerabilities-in-casaos web