GHSA-h5gf-cmm8-cg7c

CasaOS-UserService allows unauthorized access to any file

Source: GitHub Advisory Database (reviewed) High CVE-2024-24765

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/IceWhaleTech/CasaOS-UserService	< 0.4.7	0.4.7

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary http://demo.casaos.io/v1/users/image?path=/var/lib/casaos/1/avatar.png Originally it was to get the url of the user's avatar, but the path filtering was not strict, making it possible to get any file on the system. ### Details Construct paths to get any file. Such as the CasaOS user database, and furthermore can obtain system root privileges. ### PoC http://demo.casaos.io/v1/users/image?path=/var/lib/casaos/conf/../db/user.db ### Impact v0.4.6 all previous versions

References

External links from the advisory. They lead to third-party sites.

https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-h5gf-cmm8-cg7c web
https://nvd.nist.gov/vuln/detail/CVE-2024-24765 advisory
https://github.com/IceWhaleTech/CasaOS-UserService/commit/3f4558e23c0a9958f9a0e20aabc64aa8fd51840e web
https://github.com/IceWhaleTech/CasaOS-UserService package
https://github.com/IceWhaleTech/CasaOS-UserService/releases/tag/v0.4.7 web