CVE-2024-24767

CasaOS Improper Restriction of Excessive Authentication Attempts vulnerability

CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, CasaOS doesn't defend against password brute force attacks, which leads to having full access to the server. The web application lacks control over the login attempts. This vulnerability allows attackers to get super user-level access over the server. Version 0.4.7 contains a patch for this issue.

Affected

IceWhaleTech · CasaOS-UserService

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 GITHUB

9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CVSS v3.1 GitHub

7.3 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS

0.98% chance of exploitation in the next 30 days, 62nd percentile

Published

2024-03-06

Updated

2024-08-28

Proof-of-concept exploits (1)

• IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-c69x-5xmw-v44x

Security advisories

• advisories/GHSA-c69x-5xmw-v44x
• IceWhaleTech/CasaOS-UserService/commit/62006f61b55951048dbace4ebd9e483274838699

References

• CVE Record
• NVD entry