CVE-2025-34171

{"id": "CVE-2025-34171", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-34171", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-05T20:32:27.310915Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/IceWhaleTech/CasaOS", "vendor": "IceWhale Tech", "product": "CasaOS", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.4.15"}], "packageURL": "pkg:github/IceWhaleTech/CasaOS", "defaultStatus": "unaffected"}]}], "published": "2026-01-02T17:15:45.897", "references": [{"url": "https://casaos.zimaspace.com/", "tags": ["Product"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/IceWhaleTech/CasaOS", "tags": ["Product"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/casaos-unauthenticated-file-and-debug-data-exposure", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-497"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "CasaOS versions up to and including 0.4.15 expose multiple unauthenticated endpoints that allow remote attackers to retrieve sensitive configuration files and system debug information. The /v1/users/image endpoint can be abused with a user-controlled path parameter to access files under /var/lib/casaos/1/, which reveals installed applications and configuration details. Additionally, /v1/sys/debug discloses host operating system, kernel, hardware, and storage information. The endpoints also return distinct error messages, enabling file existence enumeration of arbitrary paths on the underlying host filesystem. This information disclosure can be used for reconnaissance and to facilitate targeted follow-up attacks against services deployed on the host."}, {"lang": "es", "value": "Las versiones de CasaOS hasta la 0.4.15 inclusive exponen m\u00faltiples puntos finales no autenticados que permiten a atacantes remotos recuperar archivos de configuraci\u00f3n sensibles e informaci\u00f3n de depuraci\u00f3n del sistema. El punto final /v1/users/image puede ser explotado con un par\u00e1metro de ruta controlado por el usuario para acceder a archivos bajo /var/lib/casaos/1/, lo que revela aplicaciones instaladas y detalles de configuraci\u00f3n. Adem\u00e1s, /v1/sys/debug revela informaci\u00f3n del sistema operativo del host, kernel, hardware y almacenamiento. Los puntos finales tambi\u00e9n devuelven mensajes de error distintos, lo que permite la enumeraci\u00f3n de existencia de archivos de rutas arbitrarias en el sistema de archivos del host subyacente. Esta revelaci\u00f3n de informaci\u00f3n puede utilizarse para reconocimiento y para facilitar ataques de seguimiento dirigidos contra servicios desplegados en el host."}], "lastModified": "2026-10-07T11:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:icewhale:casaos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C36AE9E0-1CA3-4610-9F81-E3A49B547500", "versionEndIncluding": "0.4.15"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}