GitHub Advisoryadvisory · Go

GHSA-vjh7-5r6x-xh6g CasaOS Gateway vulnerable to incorrect identification of source IP addresses

CRITICAL Published 2023-07-17 Modified 2024-12-12 Official page ↗
Aliases
CVE-2023-37265
Ecosystem
Go
Packages
github.com/IceWhaleTech/CasaOS-Gateway
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-306, CWE-348
Reviewed
2023-07-17

Affected packages

• Go github.com/IceWhaleTech/CasaOS-Gateway: < 0.4.4 → fixed in 0.4.4

Description

Impact Unauthenticated attackers can execute arbitrary commands as `root` on CasaOS instances. Patches The problem was addressed by improving the detection of client IP addresses in 391dd7f. This patch is part of CasaOS 0.4.4. Workarounds Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly. References • 391dd7f • https://www.sonarsource.com/blog/security-vulnerabilities-in-casaos/

Related

Alias · CVE (1)

  • CVE-2023-37265 CasaOS is an open-source Personal Cloud system. vulnerability

Weakness · CWE (2)

  • CWE-306 Missing Authentication for Critical Functionality weakness
  • CWE-348 Use of Less Trusted Source weakness

References