CVE-2024-28232: Github.com/IceWhaleTech/CasaOS UserService CasaOS Username Enumeration - Bypass Vulnerability
MODERATECVE-2024-28232 is a MODERATE (CVSS 6.2) casaos username enumeration - bypass vulnerability (CWE-204: Observable Response Discrepancy) affecting Github.com/IceWhaleTech/CasaOS UserService libraries in the Go ecosystem. The issue involves casaos username enumeration - bypass of cve-2024-24766. Remediation is available by upgrading affected packages to version 0.4.8.
CVE-2024-28232 at a Glance
Security Impact
CVSS: 6.2
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
How to Fix CVE-2024-28232
To remediate this vulnerability, upgrade all affected Github.com/IceWhaleTech/CasaOS UserService dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/IceWhaleTech/CasaOS-UserService to 0.4.8Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/IceWhaleTech/CasaOS-UserServiceHow to Check if You Are Affected
To determine whether your application is affected by CVE-2024-28232, inspect your project dependencies for Github.com/IceWhaleTech/CasaOS UserService:
inspect dependencies for github.com/IceWhaleTech/CasaOS-UserServiceAnalyze the terminal output to locate any version of Github.com/IceWhaleTech/CasaOS UserService in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.4.8), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-204: Observable Response Discrepancy, where the product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere. In Github.com/IceWhaleTech/CasaOS UserService, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2024-28232 Affected Github.com/IceWhaleTech/CasaOS UserService Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/IceWhaleTech/CasaOS-UserService
|
Go |
≥ 0.4.7
< 0.4.8
All 1 versions
0.4.7
|
0.4.8
|
References
Frequently Asked Questions
What is CVE-2024-28232?
Which Github.com/IceWhaleTech/CasaOS UserService versions are affected?
What version fixes CVE-2024-28232?
Is github.com/IceWhaleTech/CasaOS-UserService affected?
What is the CVSS score of CVE-2024-28232?
What CWE is associated with CVE-2024-28232?
How can I check Go dependencies for CVE-2024-28232?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-hcw2-2r9c-gc6p",
"modified" : "2024-04-03T18:59:29Z",
"published" : "2024-04-01T15:48:15Z",
"aliases" : [ "CVE-2024-28232" ],
"summary" : "CasaOS Username Enumeration - Bypass of CVE-2024-24766",
"details" : "### Summary\n\nThe Casa OS Login page has disclosed the username enumeration vulnerability in the login page which was patched in `CasaOS v0.4.7`.\n\n### Details\n\nIt is observed that the attacker can enumerate the CasaOS username using the application response. If the username is incorrect the application gives the error \"**User does not exist**\" with success code \"**10006**\", If the password is incorrect the application gives the error \"**User does not exist or password is invalid**\" with success code \"**10013**\".\n\n### PoC\n\n1. If the Username is invalid application gives \"User does not exist\" with success code \"**10006**\".\n\n\n\n2. If the Password is invalid application gives \"**User does not exist or password is invalid**\" with success code \"**10013**\".\n\n\n\n\n### Impact\n\nUsing this error attacker can enumerate the username of CasaOS.\n\n### The logic behind the issue\n\nThe logic behind the issue\nIf the username is incorrect, then throw an error \"**User does not exist**\" with success code \"**10006**\", else throw an error \"**User does not exist or password is invalid**\" with success code \"**10013**\".\n\nThis condition can be vice versa like:\n\nIf the password is incorrect, then throw an error \"**User does not exist or password is invalid**\" with success code \"**10013**\", else throw an error \"**User does not exist**\" with success code \"**10006**\".\n\n### Mitigation\nSince this is the condition we have to implement a single error which can be \"**Username/Password is Incorrect!!!**\" with single success code.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/IceWhaleTech/CasaOS-UserService"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0.4.7"
}, {
"fixed" : "0.4.8"
} ]
} ],
"versions" : [ "0.4.7" ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-hcw2-2r9c-gc6p"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-28232"
}, {
"type" : "WEB",
"url" : "https://github.com/IceWhaleTech/CasaOS-UserService/commit/dd927fe1c805e53790f73cfe10c7a4ded3bc5bdb"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/IceWhaleTech/CasaOS-UserService"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-204" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2024-04-01T15:48:15Z",
"nvd_published_at" : "2024-04-01T17:15:45Z"
}
}