CVE-2024-24765 json
CasaOS-UserService allows unauthorized access to any file
published 2024-03-06 2 y ago modified 2026-09-10 1 mo ago also GHSA-h5gf-cmm8-cg7c , GO-2024-2616 , EUVD-2024-0932
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 62%
- public exploits
- 0
- none known
Summary
CasaOS-UserService provides user management functionalities to CasaOS. Prior to version 0.4.7, path filtering of the URL for user avatar image files was not strict, making it possible to get any file on the system. This could allow an unauthorized actor to access, for example, the CasaOS user database, and possibly obtain system root privileges. Version 0.4.7 fixes this issue.
Patch / fix
- go github.com/IceWhaleTech/CasaOS-UserService 0.4.7
- IceWhaleTech CasaOS-UserService 0.4.7
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
0.97% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-h5gf-cmm8-cg7c referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/IceWhaleTech/CasaOS-UserService | <0.4.7 |
0.4.7 |
Affected products
- IceWhaleTech CasaOS-UserService
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
github.com
/IceWhaleTech/CasaOS-UserService/commit/3f4558e23c0a9958f9a0e20aabc64aa8fd51840e
web, patch
-
github.com
/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-h5gf-cmm8-cg7c
web, exploit, vendor-advisory, advisory
-
github.com
/IceWhaleTech/CasaOS-UserService/releases/tag/v0.4.7
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2024-24765
advisory
-
github.com
/IceWhaleTech/CasaOS-UserService
package
Sources
- CVE List CVE-2024-24765
- GitHub Advisory GHSA-h5gf-cmm8-cg7c
- NVD CVE-2024-24765
- OSV GO-2024-2616
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.