CVE-2024-24766mediumCWE-204

CVE-2024-24766: medium-severity vulnerability in IceWhaleTech CasaOS-UserService

CasaOS Username Enumeration

Published · Updated

Follow this CVE+ Monitor CasaOS-UserService+ Monitor github.com/IceWhaleTech/CasaOS-UserService

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.2epss 0.8%
In short

CasaOS login page reveals whether a username exists or not based on different error messages. This allows attackers to discover valid usernames, making it easier to target accounts with password attacks.

Technical detail

Username enumeration vulnerability in CasaOS-UserService (versions 0.4.4.3 to 0.4.6) arising from distinct error messages during authentication attempts (CWE-204). An attacker can differentiate between invalid usernames and incorrect passwords through application responses, enabling systematic user enumeration without authentication. Mitigated in version 0.4.7.

Summary generated and translated by AI from the official description.
CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, the Casa OS Login page disclosed the username enumeration vulnerability in the login page. An attacker can enumerate the CasaOS username using the application response. If the username is incorrect application gives the error `**User does not exist**`. If the password is incorrect application gives the error `**Invalid password**`. Version 0.4.7 fixes this issue.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
IceWhaleTech · CasaOS-UserService
Related CVEs — IceWhaleTech CasaOS-UserService

In the same product, most dangerous first.

CVE-2024-24767CRITICALCasaOS Improper Restriction of Excessive Authentication Attempts vulnerabilityEPSS 1.0%CVE-2024-24765HIGHCasaOS-UserService allows unauthorized access to any fileEPSS 1.0%CVE-2024-28232MEDIUMUsername Enumeration in CasaOS via bypass of CVE-2024-24766EPSS 0.6%