Vulnerability Details CVE-2023-37265
CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification an unauthenticated attackers can execute arbitrary commands as `root` on CasaOS instances. The problem was addressed by improving the detection of client IP addresses in `391dd7f`. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.919
EPSS Ranking 99.7%
CVSS Severity
CVSS v3 Score 9.8
References
- https://github.com/IceWhaleTech/CasaOS-Gateway/commit/391dd7f0f239020c46bf057cfa25f82031fc15f7
- https://github.com/IceWhaleTech/CasaOS-Gateway/security/advisories/GHSA-vjh7-5r6x-xh6g
- https://www.sonarsource.com/blog/security-vulnerabilities-in-casaos
- https://github.com/IceWhaleTech/CasaOS-Gateway/commit/391dd7f0f239020c46bf057cfa25f82031fc15f7
- https://github.com/IceWhaleTech/CasaOS-Gateway/security/advisories/GHSA-vjh7-5r6x-xh6g
Products affected by CVE-2023-37265
-
cpe:2.3:a:icewhale:casaos-gateway:0.3.5
-
cpe:2.3:a:icewhale:casaos-gateway:0.3.6
-
cpe:2.3:a:icewhale:casaos-gateway:0.3.8
-
cpe:2.3:a:icewhale:casaos-gateway:0.4.0
-
cpe:2.3:a:icewhale:casaos-gateway:0.4.1
-
cpe:2.3:a:icewhale:casaos-gateway:0.4.2
-
cpe:2.3:a:icewhale:casaos-gateway:0.4.4
-
cpe:2.3:o:icewhale:casaos:-
-
cpe:2.3:o:icewhale:casaos:0.1.0
-
cpe:2.3:o:icewhale:casaos:0.1.1
-
cpe:2.3:o:icewhale:casaos:0.1.10
-
cpe:2.3:o:icewhale:casaos:0.1.11
-
cpe:2.3:o:icewhale:casaos:0.1.2
-
cpe:2.3:o:icewhale:casaos:0.1.3
-
cpe:2.3:o:icewhale:casaos:0.1.4
-
cpe:2.3:o:icewhale:casaos:0.1.5
-
cpe:2.3:o:icewhale:casaos:0.1.6
-
cpe:2.3:o:icewhale:casaos:0.1.7
-
cpe:2.3:o:icewhale:casaos:0.1.8
-
cpe:2.3:o:icewhale:casaos:0.1.9
-
cpe:2.3:o:icewhale:casaos:0.2.0
-
cpe:2.3:o:icewhale:casaos:0.2.1
-
cpe:2.3:o:icewhale:casaos:0.2.10
-
cpe:2.3:o:icewhale:casaos:0.2.2
-
cpe:2.3:o:icewhale:casaos:0.2.3
-
cpe:2.3:o:icewhale:casaos:0.2.4
-
cpe:2.3:o:icewhale:casaos:0.2.5
-
cpe:2.3:o:icewhale:casaos:0.2.6
-
cpe:2.3:o:icewhale:casaos:0.2.7
-
cpe:2.3:o:icewhale:casaos:0.2.8
-
cpe:2.3:o:icewhale:casaos:0.2.9
-
cpe:2.3:o:icewhale:casaos:0.3.0
-
cpe:2.3:o:icewhale:casaos:0.3.1
-
cpe:2.3:o:icewhale:casaos:0.3.1.1
-
cpe:2.3:o:icewhale:casaos:0.3.2
-
cpe:2.3:o:icewhale:casaos:0.3.2.1
-
cpe:2.3:o:icewhale:casaos:0.3.3
-
cpe:2.3:o:icewhale:casaos:0.3.4
-
cpe:2.3:o:icewhale:casaos:0.3.5
-
cpe:2.3:o:icewhale:casaos:0.3.5.1
-
cpe:2.3:o:icewhale:casaos:0.3.6
-
cpe:2.3:o:icewhale:casaos:0.3.7
-
cpe:2.3:o:icewhale:casaos:0.3.7-1
-
cpe:2.3:o:icewhale:casaos:0.3.7.1
-
cpe:2.3:o:icewhale:casaos:0.3.8
-
cpe:2.3:o:icewhale:casaos:0.4.1
-
cpe:2.3:o:icewhale:casaos:0.4.2
-
cpe:2.3:o:icewhale:casaos:0.4.3
-
cpe:2.3:o:icewhale:casaos:0.4.3-1
-
cpe:2.3:o:icewhale:casaos:0.4.4