CVE-2023-37469 CasaOS Command Injection vulnerability

What is CVE-2023-37469?

CVE-2023-37469 is a high-severity command injection vulnerability in IceWhaleTech CasaOS, published on 24 Aug 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connect to a controlled SMB server, they are able to execute arbitrary commands. Version 0.4.4 contains a patch for the issue.

Weakness: CWE-77

Which versions are affected by CVE-2023-37469?

3 open source packages ship an affected version, including github.com/IceWhaleTech/CasaOS. It affects 1 product.

Products include Icewhale Casaos.

How do I fix CVE-2023-37469?

Upgrade github.com/IceWhaleTech/CasaOS to 0.4.4 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2023-37469 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-37469 exists.

Other vulnerabilities in IceWhaleTech CasaOS

• CVE-2023-37265 Incorrect identification of source IP addresses in CasaOS Critical 9.8
• CVE-2023-37266 Weak json web token (JWT) secrets in CasaOS Critical 9.8
• CVE-2022-24193 Command Injection in CasaOS Critical 9.8
• CVE-2024-24767 CasaOS Improper Restriction of Excessive Authentication Attempts vulnerability Critical 9.1
• CVE-2024-24765 CasaOS-UserService allows unauthorized access to any file High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-92vc-4fcw-g68q, GO-2023-2026.