CVE-2023-37265
Published: 17 July 2023
Summary
CVE-2023-37265 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Icewhale Casaos. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CasaOS is an open-source personal cloud system affected by CVE-2023-37265, a missing authentication vulnerability (CWE-306) stemming from insufficient IP address verification in the gateway component. This flaw permits unauthenticated remote attackers to execute arbitrary commands with root privileges on exposed instances, reflected in the CVSS 3.1 score of 9.8.
An attacker with network access to a CasaOS instance can exploit the lack of client IP validation to inject and run commands as root without any credentials or user interaction, leading to full system compromise including data access, modification, and persistence.
The official advisories and patch in commit 391dd7f, released as part of CasaOS 0.4.4, address the issue by strengthening client IP detection. Users unable to upgrade are advised to restrict public exposure of CasaOS to untrusted networks.
The EPSS score has remained at a high of 0.9112 without a documented rise from a lower baseline.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-2152
Vulnerability details
CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification an unauthenticated attackers can execute arbitrary commands as `root` on CasaOS instances. The problem was addressed by improving the detection of client IP addresses in…
more
`391dd7f`. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requires established identification and authentication to unlock, mitigating missing authentication for continued system access.
Requiring identification and rationale for actions allowed without authentication ensures critical functions are not left unprotected by forcing review of authentication requirements.
Authorizing mobile device connections to organizational systems ensures authentication is performed for this critical access function.
Guarantees critical functions are protected by mandatory invocation of the access control mechanism.
Auditing sessions makes it possible to detect access to critical functions without required authentication.
The assessment process confirms authentication is present and effective for critical functions, preventing exploitation from missing authentication.
Certification assesses that critical functions have required authentication controls in place.
Disabling non-essential functions and services eliminates the need to secure them, reducing exposure from missing authentication on unnecessary components.