CVE-2024-24765
📋 TL;DR
CVE-2024-24765 is a path traversal vulnerability in CasaOS-UserService that allows unauthorized file access due to insufficient URL filtering for avatar images. Attackers can read arbitrary files on the system, potentially accessing sensitive data like user databases. This affects CasaOS installations using CasaOS-UserService versions before 0.4.7.
💻 Affected Systems
- CasaOS-UserService
📦 What is this software?
Casaos by Icewhale
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain root privileges by reading sensitive system files, compromising the entire CasaOS installation and potentially the underlying host system.
Likely Case
Unauthorized access to CasaOS user database and configuration files, leading to credential theft and privilege escalation within CasaOS.
If Mitigated
Limited to reading non-critical files if proper file permissions and network segmentation are implemented.
🎯 Exploit Status
The vulnerability requires no authentication and involves simple path traversal techniques. While no public PoC exists, exploitation is straightforward based on the advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.4.7
Vendor Advisory: https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-h5gf-cmm8-cg7c
Restart Required: Yes
Instructions:
1. Update CasaOS-UserService to version 0.4.7 or later. 2. Restart the CasaOS-UserService. 3. Verify the service is running the patched version.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to CasaOS-UserService to trusted IPs only
sudo ufw allow from TRUSTED_IP to any port CASAOS_PORT
sudo ufw deny CASAOS_PORT
File Permission Hardening
linuxSet strict permissions on sensitive files to limit damage if exploited
sudo chmod 600 /path/to/sensitive/files
sudo chown root:root /path/to/sensitive/files
🧯 If You Can't Patch
- Isolate CasaOS instance from internet and restrict to internal network only
- Implement strict file system permissions and monitor for unauthorized file access attempts
🔍 How to Verify
Check if Vulnerable:
Check CasaOS-UserService version: if version < 0.4.7, system is vulnerableCheck Version:
Check CasaOS-UserService logs or configuration for version information, or run: systemctl status casaos-userservice | grep versionVerify Fix Applied:
Confirm CasaOS-UserService version is 0.4.7 or higher and test that path traversal attempts to access system files are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in CasaOS-UserService logs
- Multiple failed or successful attempts to access files outside avatar directory
Network Indicators:
- HTTP requests with path traversal sequences (../) to CasaOS-UserService avatar endpoints
SIEM Query:
source="casaos-userservice" AND (url="*../*" OR status=200 AND url!="*/avatar/*")🔗 References
- https://github.com/IceWhaleTech/CasaOS-UserService/commit/3f4558e23c0a9958f9a0e20aabc64aa8fd51840e
- https://github.com/IceWhaleTech/CasaOS-UserService/releases/tag/v0.4.7
- https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-h5gf-cmm8-cg7c
- https://github.com/IceWhaleTech/CasaOS-UserService/commit/3f4558e23c0a9958f9a0e20aabc64aa8fd51840e
- https://github.com/IceWhaleTech/CasaOS-UserService/releases/tag/v0.4.7
- https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-h5gf-cmm8-cg7c
