CVE-2022-24193: Command Injection in CasaOS
Summary
CVE-2022-24193: Command Injection in CasaOS. Affects github.com/IceWhaleTech/CasaOS versions < 0.2.8. Fixed in 0.2.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CasaOS is a Go package developed by IceWhaleTech. It provides functionality for managing and controlling CasaOS, a software system. CasaOS allows users to join or leave a zerotier network. However, versions prior to v0.2.7 are vulnerable to a command injection vulnerability. This vulnerability can be exploited through the component leave or join zerotier API.
Vulnerability Detail
The command injection vulnerability in CasaOS allows an attacker to execute arbitrary commands on the system. By manipulating the input parameters of the leave or join zerotier API, an attacker can inject malicious commands that will be executed by the underlying system. This can lead to unauthorized access, data leakage, or even complete compromise of the system. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Minimum fixed version
0.2.8
This is the first release that contains the fix.
go get github.com/IceWhaleTech/CasaOS@v0.2.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the latest version of the CasaOS package.
Conclusion
In conclusion, CasaOS versions prior to v0.2.7 are vulnerable to a command injection vulnerability. Users should upgrade to version 0.2.8 or later to fix this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/IceWhaleTech/CasaOS →
FAQ
CasaOS is a software system developed by IceWhaleTech that provides management and control functionalities.
The vulnerability allows an attacker to execute arbitrary commands on the system, potentially leading to unauthorized access or complete compromise of the system.
To fix this vulnerability, upgrade to version 0.2.8 or later of the CasaOS package.
No, there is no known workaround. It is recommended to upgrade to the latest version of the CasaOS package.
The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/IceWhaleTech/CasaOS.
