CVE-2024-49357

HIGHNuclei

ZimaOS (Installed Applications and System Information) has Unauthorized Sensitive Data Leak

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-49357 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template.

Description

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoints in ZimaOS, such as `http://<Server-IP>/v1/users/image?path=/var/lib/casaos/1/app_order.json` and `http://<Server-IP>/v1/users/image?path=/var/lib/casaos/1/system.json`, expose sensitive data like installed applications and system information without requiring any authentication or authorization. This sensitive data leak can be exploited by attackers to gain detailed knowledge about the system setup, installed applications, and other critical information. As of time of publication, no known patched versions are available.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 25, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

ZimaOS

Browse IceWhaleTech / ZimaOS

Default status: unknown

CVE List<= 1.2.4affected
Through 1.2.4affected

Nuclei templates

1
ProjectDiscoveryHIGHZimaOS <= v1.2.4 - Sensitive Information DisclosureCVSS 7.5

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoints in ZimaOS, such as `http://<Server-IP>/v1/users/image?path=/var/lib/casaos/1/app_order.json` and `http://<Server-IP>/v1/users/image?path=/var/lib/casaos/1/system.json`, expose sensitive data like installed applications and system information without requiring any authentication or authorization. This sensitive data leak can be exploited by attackers to gain detailed knowledge about the system setup, installed applications, and other critical information. As of time of publication, no known patched versions are available.

Impact

Attackers can access sensitive system and application data, potentially aiding further malicious activities or reconnaissance.

Remediation

Upgrade ZimaOS to v1.2.5 or later.

WeaknessesCWE-200CWE-862
AuthorsDhiyaneshDk
Template tagscvecve2024zimaoscasaosexposure
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Shodan: ZimaOS
https://nvd.nist.gov/vuln/detail/CVE-2024-49357 https://github.com/IceWhaleTech/ZimaOS/issues https://github.com/advisories/GHSA-hg2h-q5h6-r5c4

Source: ProjectDiscovery

References

2