CVE-2024-28232 Username Enumeration in CasaOS via bypass of CVE-2024-24766
Attackers can enumerate valid usernames on CasaOS login pages, bypassing previous fixes, potentially aiding further attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-28232?
CVE-2024-28232 is a medium-severity vulnerability in IceWhaleTech CasaOS-UserService, published on 1 Apr 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vulnerability in the login page which was patched in version 0.4.7. This issue in CVE-2024-28232 has been patched in version 0.4.8 but that version has not yet been uploaded to Go's package manager.
Weakness: CWE-204
Which versions are affected by CVE-2024-28232?
3 open source packages ship an affected version, including github.com/IceWhaleTech/CasaOS-UserService. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/IceWhaleTech/CasaOS-UserService Go | All versions | 0.4.8 |
github.com/IceWhaleTech/CasaOS-UserService Go | From 0.4.7 | 0.4.8 |
github.com/IceWhaleTech/CasaOS-UserService Go | From 0.4.7 | 0.4.8 |
Products include Icewhale Casaos-Userservice.
How do I fix CVE-2024-28232?
Upgrade github.com/IceWhaleTech/CasaOS-UserService to 0.4.8 or later.
Is CVE-2024-28232 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-28232 exists.
Other vulnerabilities in IceWhaleTech CasaOS-UserService
Sources
Also known as GHSA-hcw2-2r9c-gc6p, GO-2024-2668.