CVE-2025-34171
📋 TL;DR
CasaOS versions up to 0.4.15 expose unauthenticated endpoints that allow remote attackers to retrieve sensitive configuration files and system debug information. Attackers can access application configurations, system details, and enumerate files on the host filesystem. This affects all CasaOS deployments running vulnerable versions.
💻 Affected Systems
- CasaOS
📦 What is this software?
Casaos by Icewhale
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain complete reconnaissance of the system including installed applications, configurations, and file system structure, enabling targeted follow-up attacks like privilege escalation or service exploitation.
Likely Case
Information disclosure revealing application configurations, system details, and file enumeration that facilitates reconnaissance for further attacks.
If Mitigated
Limited to authenticated users only, preventing unauthorized access to sensitive system information.
🎯 Exploit Status
Exploitation requires only HTTP requests to specific endpoints with crafted parameters. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.4.16 or later
Vendor Advisory: https://github.com/IceWhaleTech/CasaOS
Restart Required: Yes
Instructions:
1. Check current CasaOS version. 2. Update to version 0.4.16 or later via package manager or manual installation. 3. Restart CasaOS service.
🔧 Temporary Workarounds
Network Access Control
linuxRestrict network access to CasaOS web interface using firewall rules
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Reverse Proxy Authentication
allPlace CasaOS behind a reverse proxy with authentication requirements
🧯 If You Can't Patch
- Isolate CasaOS instance on separate network segment with strict firewall rules
- Monitor for suspicious requests to /v1/users/image and /v1/sys/debug endpoints
🔍 How to Verify
Check if Vulnerable:
Test if unauthenticated requests to http://[CASAOS_IP]/v1/users/image?path=../../../../etc/passwd return file contents or error messagesCheck Version:
casaos --version or check web interface dashboardVerify Fix Applied:
After patching, verify that unauthenticated requests to vulnerable endpoints return proper authentication errors or are disabled📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /v1/users/image with path parameters
- HTTP requests to /v1/sys/debug
- Multiple 200/403 responses from these endpoints
Network Indicators:
- Unusual volume of requests to /v1/users/image endpoint
- Requests with path traversal patterns (../)
SIEM Query:
source="casaos" AND (url="/v1/users/image" OR url="/v1/sys/debug")