Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/IceWhaleTech/CasaOS-UserService

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.2GoPublished

    CasaOS Username Enumeration - Bypass of CVE-2024-24766

    CVE-2024-28232 · GHSA-hcw2-2r9c-gc6p

    Affected
    • Go github.com/IceWhaleTech/CasaOS-UserService >= 0.4.7, <= 0.4.7
    Fixed in
    0.4.8· Vendor fix available
    Issue
    The Casa OS Login page has disclosed the username enumeration vulnerability in the login page which was patched in CasaOS v0.4.7. Details It is observed that the attacker can enumerate the CasaOS username using the application response. If the username is incorrect the application gives the error "User does not exist" with success code "10006", If the password is incorrect the application gives the error "User does not exist or password is invalid" with success code "10013". PoC 1. If the Username is invalid application gives "User does not exist" with success code "10006". 2. If the Password is invalid application gives "User does not exist or password is invalid" with success code "10013". Impact Using this error attacker can enumerate the username of CasaOS. The logic behind the issue The logic behind the issue If the username is incorrect, then throw an error "User does not exist" with success code "10006", else throw an error "User does not exist or password is invalid"…

    Recommended action: Upgrade to 0.4.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. High, CVSS 7.5GoPublished

    CasaOS-UserService allows unauthorized access to any file

    CVE-2024-24765 · GHSA-h5gf-cmm8-cg7c

    Affected
    • Go github.com/IceWhaleTech/CasaOS-UserService < 0.4.7
    Fixed in
    0.4.7· Vendor fix available
    Issue
    http://demo.casaos.io/v1/users/image?path=/var/lib/casaos/1/avatar.png Originally it was to get the url of the user's avatar, but the path filtering was not strict, making it possible to get any file on the system. Details Construct paths to get any file. Such as the CasaOS user database, and furthermore can obtain system root privileges. PoC http://demo.casaos.io/v1/users/image?path=/var/lib/casaos/conf/../db/user.db Impact v0.4.6 all previous versions

    Recommended action: Upgrade to 0.4.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →