CVE-2023-37266criticalCWE-287

CVE-2023-37266: critical vulnerability in IceWhaleTech CasaOS

Weak json web token (JWT) secrets in CasaOS

Published · Updated

Follow this CVE+ Monitor CasaOS+ Monitor github.com/IceWhaleTech/CasaOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 9.8epss 6.8%
CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as `root` on CasaOS instances. This problem was addressed by improving the validation of JWTs in commit `705bf1f`. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
IceWhaleTech · CasaOS
Related CVEs — IceWhaleTech CasaOS

In the same product, most dangerous first.

CVE-2023-37469HIGHCasaOS Command Injection vulnerabilityEPSS 1.6%