CVE-2024-24767 CasaOS Improper Restriction of Excessive Authentication Attempts vulnerability

2024-03-0618:06:26

CWE-307

GitHub_M

github.com

casaos

userservice

authentication

vulnerability

web application

patch

version 0.4.7

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

6.8

Confidence

Low

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

total

JSON

CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, CasaOS doesn’t defend against password brute force attacks, which leads to having full access to the server. The web application lacks control over the login attempts. This vulnerability allows attackers to get super user-level access over the server. Version 0.4.7 contains a patch for this issue.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:icewhaletech:casaos-userservice:*:*:*:*:*:*:*:*"
    ],
    "vendor": "icewhaletech",
    "product": "casaos-userservice",
    "versions": [
      {
        "status": "affected",
        "version": "0.4.4.3",
        "lessThan": "0.4.7",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]