CasaOS <= 0.4.15 Information Disclosure Vulnerability - Version Check

# SPDX-FileCopyrightText: 2026 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/o:icewhale:casaos";

if (description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.156135");
  script_version("2026-02-27T05:55:46+0000");
  script_tag(name:"last_modification", value:"2026-02-27 05:55:46 +0000 (Fri, 27 Feb 2026)");
  script_tag(name:"creation_date", value:"2026-01-13 08:30:17 +0000 (Tue, 13 Jan 2026)");
  script_tag(name:"cvss_base", value:"5.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2026-02-26 21:57:55 +0000 (Thu, 26 Feb 2026)");

  script_cve_id("CVE-2025-34171");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"NoneAvailable");

  script_name("CasaOS <= 0.4.15 Information Disclosure Vulnerability - Version Check");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2026 Greenbone AG");
  script_family("Web application abuses");
  script_dependencies("gb_casaos_http_detect.nasl");
  script_mandatory_keys("casaos/detected");

  script_tag(name:"summary", value:"CasaOS is prone to an information disclosure vulnerability.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"CasaOS exposes multiple unauthenticated endpoints that allow
  remote attackers to retrieve sensitive configuration files and system debug information. The
  /v1/users/image endpoint can be abused with a user-controlled path parameter to access files
  under /var/lib/casaos/1/, which reveals installed applications and configuration details.
  Additionally, /v1/sys/debug discloses host operating system, kernel, hardware, and storage
  information. The endpoints also return distinct error messages, enabling file existence
  enumeration of arbitrary paths on the underlying host filesystem. This information disclosure can
  be used for reconnaissance and to facilitate targeted follow-up attacks against services deployed
  on the host.");

  script_tag(name:"affected", value:"CasaOS version 0.4.15 and prior.");

  script_tag(name:"solution", value:"No known solution is available as of 13th January, 2026.
  Information regarding this issue will be updated once solution details are available.");

  script_xref(name:"URL", value:"https://www.vulncheck.com/advisories/casaos-unauthenticated-file-and-debug-data-exposure");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (!port = get_app_port(cpe: CPE))
  exit(0);

if (!version = get_app_version(cpe: CPE, port: port))
  exit(0);

if (version_is_less_equal(version: version, test_version: "0.4.15")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "None");
  security_message(port: port, data: report);
  exit(0);
}

exit(0);