CVE-2023-37265 json
Incorrect identification of source IP addresses in CasaOS
published 2023-07-17 3 y ago modified 2026-09-10 1 mo ago also GHSA-vjh7-5r6x-xh6g , GO-2023-1932 , EUVD-2023-2152
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 7.4%
- EPSS 7.4% chance of exploitation in 30 days, percentile 94%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification an unauthenticated attackers can execute arbitrary commands as `root` on CasaOS instances. The problem was addressed by improving the detection of client IP addresses in `391dd7f`. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.
Patch / fix
- go github.com/IceWhaleTech/CasaOS-Gateway 0.4.4
- icewhale casaos-gateway 0.4.4
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
7.36% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template CasaOS < 0.4.4 - Authentication Bypass via Internal IP nuclei detection template
- sonarsource.com https://www.sonarsource.com/blog/security-vulnerabilities-in-casaos referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/IceWhaleTech/CasaOS-Gateway | <0.4.4 |
0.4.4 |
Affected products
- IceWhaleTech CasaOS-Gateway
- icewhale casaos-gateway
Classification
References
-
github.com
/IceWhaleTech/CasaOS-Gateway/commit/391dd7f0f239020c46bf057cfa25f82031fc15f7
web, patch
-
github.com
/IceWhaleTech/CasaOS-Gateway/security/advisories/GHSA-vjh7-5r6x-xh6g
web, patch, vendor-advisory, advisory
-
sonarsource.com
/blog/security-vulnerabilities-in-casaos
web, exploit, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-37265
advisory
-
github.com
/IceWhaleTech/CasaOS-Gateway
package
-
pkg.go.dev
/vuln/GO-2023-1932
web
Sources
- CVE List CVE-2023-37265
- GitHub Advisory GHSA-vjh7-5r6x-xh6g
- NVD CVE-2023-37265
- OSV GO-2023-1932
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.