high7.5
CVE-2024-24765
CasaOS-UserService allows unauthorized access to any file
Impact
### Summary http://demo.casaos.io/v1/users/image?path=/var/lib/casaos/1/avatar.png Originally it was to get the url of the user's avatar, but the path filtering was not strict, making it possible to get any file on the system. ### Details Construct paths to get any file. Such as the CasaOS user database, and furthermore can obtain system root privileges. ### PoC http://demo.casaos.io/v1/users/image?path=/var/lib/casaos/conf/../db/user.db ### Impact v0.4.6 all previous versions
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/IceWhaleTech/CasaOS-UserService | < 0.4.7 | 0.4.7 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Icewhale | Casaos | before 0.4.7 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/IceWhaleTech/CasaOS-UserService/commit/3f4558e23c0a9958f9a0e20aabc64aa8fd51840e
- https://github.com/IceWhaleTech/CasaOS-UserService/releases/tag/v0.4.7
- https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-h5gf-cmm8-cg7c
- https://github.com/advisories/GHSA-h5gf-cmm8-cg7c
- https://nvd.nist.gov/vuln/detail/CVE-2024-24765