CasaOS-UserService allows unauthorized access to any file
### Summary http://demo.casaos.io/v1/users/image?path=/var/lib/casaos/1/avatar.png Originally it was to get the url of the user's avatar, but the path filtering was not strict, making it possible to get any file on the system. ### Details Construct paths to get any file. Such as the CasaOS user database, and furthermore can obtain system root privileges. ### PoC http://demo.casaos.io/v1/users/image?path=/var/lib/casaos/conf/../db/user.db ### Impact v0.4.6 all previous versions
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-24765US | critical9.8 | — | ||
CasaOS-UserService provides user management functionalities to CasaOS. Prior to version 0.4.7, path filtering of the URL for user avatar image files was not strict, making it possi… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/IceWhaleTech/CasaOS-UserServicePACKAGE
- https://github.com/IceWhaleTech/CasaOS-UserService/commit/3f4558e23c0a9958f9a0e20aabc64aa8fd51840eWEB
- https://github.com/IceWhaleTech/CasaOS-UserService/releases/tag/v0.4.7WEB
- https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-h5gf-cmm8-cg7cWEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-24765ADVISORY
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan