Executive brief
CasaOS, an open-source personal cloud system used for managing home servers and Docker applications, contains a security flaw that allows anyone on the network to access sensitive system information without a password. An attacker can use this to view configuration files, details about installed applications, and technical hardware specifications. This information can be used to plan more advanced attacks against the server or the data stored on it.
Technical details
CasaOS versions up to and including 0.4.15 suffer from missing authorization (CWE-862) on several API endpoints. Specifically, the `/v1/users/image` endpoint allows an attacker to use a path parameter to access files within `/var/lib/casaos/1/`, exposing application and configuration data. The `/v1/sys/debug` endpoint leaks host-level details including OS, kernel, hardware, and storage info. Furthermore, the API returns distinct error messages that allow an attacker to enumerate the existence of arbitrary files across the host filesystem. These vulnerabilities can be exploited remotely without authentication to facilitate reconnaissance for subsequent attacks.
Affected products
- IceWhale Tech CasaOS <= 0.4.15
Timeline
- 2025-01-02: disclosed: Initial CVE publication date
- 2026-01-02: advisory: NVD and VulnCheck advisory publication