CVE-2023-37266 — Vulnerability in github.com/IceWhaleTech/CasaOS —...

CRITICAL

CasaOS contains weak JWT secrets

Published July 17, 2023Updated December 12, 2024Source: osv

Summary

### Impact Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as `root` on CasaOS instances. ### Patches The problem was addressed by improving the validation of JWTs in 705bf1f. This patch is part of CasaOS 0.4.4. ### Workarounds Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly. ### References - 705bf1f - https://www.sonarsource.com/blog/security-vulnerabilities-in-casaos/

Advisory Timeline

First published July 17, 2023 (1183 days ago).
Last revised December 12, 2024 — 514 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Update github.com/IceWhaleTech/CasaOS to 0.4.4 or later

go get github.com/IceWhaleTech/CasaOS@v0.4.4

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: go (1).

Package	Ecosystem	Affected	Fixed In
github.com/IceWhaleTech/CasaOS	go	All versions	0.4.4

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-1391
View on MITRE
CWE-287
Improper AuthenticationMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2023-37266?: CasaOS contains weak JWT secrets This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2023-37266?: CVE-2023-37266 affects github.com/IceWhaleTech/CasaOS. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2023-37266 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-m5q5-8mfw-p2hr

GO-2023-1931

Related CVEs

CVE-2026-107806
CRITICAL
Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
CVE-2026-68582
CRITICAL
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)
CVE-2023-37265
CRITICAL
CasaOS Gateway vulnerable to incorrect identification of source IP addresses

More Go Modules advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies