CVE-2023-37266
📋 TL;DR
CVE-2023-37266 allows unauthenticated attackers to bypass authentication in CasaOS by crafting arbitrary JWTs, gaining root access to execute arbitrary commands. This affects all CasaOS instances running vulnerable versions. The vulnerability enables complete system compromise.
💻 Affected Systems
- CasaOS
📦 What is this software?
Casaos by Icewhale
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with root privileges, data theft, ransomware deployment, and persistent backdoor installation.
Likely Case
Unauthenticated attackers gain root access to execute arbitrary commands, potentially compromising the entire CasaOS instance and underlying host.
If Mitigated
No impact if properly patched or isolated from untrusted networks.
🎯 Exploit Status
Exploitation requires crafting a JWT with specific claims. Public technical details and proof-of-concept code are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.4.4
Vendor Advisory: https://github.com/IceWhaleTech/CasaOS/security/advisories/GHSA-m5q5-8mfw-p2hr
Restart Required: Yes
Instructions:
1. Backup CasaOS data and configuration. 2. Stop CasaOS service. 3. Update to version 0.4.4 using your package manager or manual installation. 4. Restart CasaOS service. 5. Verify the update was successful.
🔧 Temporary Workarounds
Network Isolation
linuxRestrict network access to CasaOS to trusted IP addresses only
sudo ufw allow from TRUSTED_IP to any port 80,443
sudo ufw deny from any to any port 80,443
🧯 If You Can't Patch
- Immediately restrict network access to CasaOS to trusted IP addresses only
- Consider temporarily disabling CasaOS until patching is possible
🔍 How to Verify
Check if Vulnerable:
Check CasaOS version. If version is below 0.4.4, the system is vulnerable.Check Version:
casaos --version || grep version /usr/local/casaos/version.txtVerify Fix Applied:
Verify CasaOS version is 0.4.4 or higher and test authentication requirements for API endpoints.📡 Detection & Monitoring
Log Indicators:
- Unusual authentication attempts with crafted JWTs
- Root-level command execution from unauthenticated sources
- Failed JWT validation logs
Network Indicators:
- Unauthenticated API requests to sensitive endpoints
- Unusual outbound connections from CasaOS host
SIEM Query:
source="casaos" AND (event="authentication_failure" OR event="root_command")🔗 References
- https://github.com/IceWhaleTech/CasaOS/commit/705bf1facbffd2ca40b159b0303132b6fdf657ad
- https://github.com/IceWhaleTech/CasaOS/security/advisories/GHSA-m5q5-8mfw-p2hr
- https://www.sonarsource.com/blog/security-vulnerabilities-in-casaos
- https://github.com/IceWhaleTech/CasaOS/commit/705bf1facbffd2ca40b159b0303132b6fdf657ad
- https://github.com/IceWhaleTech/CasaOS/security/advisories/GHSA-m5q5-8mfw-p2hr
