Publish Advisories

GHSA-c69x-5xmw-v44x GHSA-c967-2652-gfjm
2026-05-22 18:04:22 -07:00 · 2024-03-06 15:26:42 +00:00
parent 6b29e99206
commit f174f05a4b
2 changed files with 130 additions and 0 deletions
@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-c69x-5xmw-v44x",
+  "modified": "2024-03-06T15:25:08Z",
+  "published": "2024-03-06T15:25:08Z",
+  "aliases": [
+    "CVE-2024-24767"
+  ],
+  "summary": "CasaOS Improper Restriction of Excessive Authentication Attempts vulnerability",
+  "details": "### Summary\nHere it is observed that the CasaOS doesn't defend against password brute force attacks, which leads to having full access to the server.\n\n### Details\nThe web application lacks control over the login attempts i.e. why attacker can use a password brute force attack to find and get full access over the.\n\n### PoC\n1. Capture login request in proxy tool like Burp Suite and select password field.\n\n![1](https://user-images.githubusercontent.com/63414468/297156515-0272bfd7-f386-4c22-b3bd-c4dbdc1298bf.PNG)\n\n2. Here I have started attack with total number of 271 password tries where the last one is the correct password and as we can see in the following image we get a **400 Bad Request** status code with the message \"**Invalid Password**\" and response length **769** on 1st request which was sent at **_Tue, 16 Jan 2024 18:31:32 GMT_**\n\n![2](https://user-images.githubusercontent.com/63414468/297157815-c158995b-7d46-4a5a-aef9-bcbbcf596b15.png)\n\n**Note**:  _We have tested this vulnerability with more than 3400 tries. We have used 271 request counts just for demo purposes._\n\n\n3. Here the attack is completed and we can see in the following image we get **200 OK** status code with the message \"**Ok**\" and response length **1509** on 271st request which was sent at **_Tue, 16 Jan 2024 18:32:01 GMT_**.\n\n![3](https://user-images.githubusercontent.com/63414468/297159282-3f4788b5-6217-4f32-8be6-40ac117710e3.png)\n\nThis means attacker can try 271 requests in 56 seconds.\n\n### Impact\nThis vulnerability allows attackers to get super user-level access over the server.\n\n\n### Mitigation\nIt is recommended to implement a proper rate-limiting mechanism on the server side where the configuration might be like:\nIf a specific IP address fails to login more than 5 times concurrently then that IP address must be blocked for at least 30 seconds. This will reduce the possibility of password brute-forcing attacks.\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/IceWhaleTech/CasaOS-UserService"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0.4.4.3"
+            },
+            {
+              "fixed": "0.4.7"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-c69x-5xmw-v44x"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/IceWhaleTech/CasaOS-UserService/commit/62006f61b55951048dbace4ebd9e483274838699"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/IceWhaleTech/CasaOS-UserService"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/IceWhaleTech/CasaOS-UserService/releases/tag/v0.4.7"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-307"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-03-06T15:25:08Z",
+    "nvd_published_at": null
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-c967-2652-gfjm",
+  "modified": "2024-03-06T15:23:53Z",
+  "published": "2024-03-06T15:23:53Z",
+  "aliases": [
+    "CVE-2024-24766"
+  ],
+  "summary": "CasaOS Username Enumeration",
+  "details": "### Summary\n\nThe Casa OS Login page has disclosed the username enumeration vulnerability in the login page.\n\n### Details\n\nIt is observed that the attacker can enumerate the CasaOS username using the application response. If the username is incorrect application gives the error \"**User does not exist**\",  If the password is incorrect application gives the error \"**Invalid password**\". \n\n### PoC\n\nCapture the login request in a tool like Burp Suit and use the intruder tab for trying multiple usernames. \nKeep checking the response of each request if the response says **Invalid password** then the username is right.\n\n### Impact\n\nUsing this error attacker can enumerate the username of CasaOS. \n\n### The logic behind the issue\n\nIf the username is incorrect, then throw an error \"User does not exist\" else throw an error \"Invalid password\".\n\nThis condition can be vice versa like:\n\nIf the password is incorrect, then throw an error \"Invalid password\" else throw an error \"User does not exist\".\n\n### Mitigation\n\nSince this is the condition we have to implement a single error which can be \"Username/Password is Incorrect!!!\"\n\n\n\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/IceWhaleTech/CasaOS-UserService"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0.4.4.3"
+            },
+            {
+              "fixed": "0.4.7"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-c967-2652-gfjm"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/IceWhaleTech/CasaOS-UserService/commit/c75063d7ca5800948e9c09c0a6efe9809b5d39f7"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/IceWhaleTech/CasaOS-UserService"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/IceWhaleTech/CasaOS-UserService/releases/tag/v0.4.7"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-204"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-03-06T15:23:53Z",
+    "nvd_published_at": null
+  }
+}