CVE-2023-37266 json
Weak json web token (JWT) secrets in CasaOS
published 2023-07-17 3 y ago modified 2026-06-17 4 mo ago also GHSA-m5q5-8mfw-p2hr , GO-2023-1931 , EUVD-2023-2095
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 6.8%
- EPSS 6.8% chance of exploitation in 30 days, percentile 94%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as `root` on CasaOS instances. This problem was addressed by improving the validation of JWTs in commit `705bf1f`. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.
Patch / fix
- go github.com/IceWhaleTech/CasaOS 0.4.4
- icewhale casaos 0.4.4
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
6.84% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template CasaOS < 0.4.4 - Authentication Bypass via Random JWT Token nuclei detection template
- sonarsource.com https://www.sonarsource.com/blog/security-vulnerabilities-in-casaos referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/IceWhaleTech/CasaOS | <0.4.4 |
0.4.4 |
Affected products
- IceWhaleTech CasaOS
- icewhale casaos
Classification
References
-
github.com
/IceWhaleTech/CasaOS/commit/705bf1facbffd2ca40b159b0303132b6fdf657ad
web, patch
-
github.com
/IceWhaleTech/CasaOS/security/advisories/GHSA-m5q5-8mfw-p2hr
web, patch, third-party-advisory, advisory
-
sonarsource.com
/blog/security-vulnerabilities-in-casaos
web, exploit, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-37266
advisory
-
github.com
/IceWhaleTech/CasaOS
package
-
pkg.go.dev
/vuln/GO-2023-1931
web
Sources
- CVE List CVE-2023-37266
- GitHub Advisory GHSA-m5q5-8mfw-p2hr
- NVD CVE-2023-37266
- OSV GO-2023-1931
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.