CVE-2024-49357

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoints in ZimaOS, such as `http://<Server-IP>/v1/users/image?path=/var/lib/casaos/1/app_order.json` and `http://<Server-IP>/v1/users/image?path=/var/lib/casaos/1/system.json`, expose sensitive data like installed applications and system information without requiring any authentication or authorization. This sensitive data leak can be exploited by attackers to gain detailed knowledge about the system setup, installed applications, and other critical information. As of time of publication, no known patched versions are available.
Configurations

Configuration 1 (hide)

cpe:2.3:a:zimaspace:zimaos:*:*:*:*:*:*:*:*

History

06 Nov 2024, 15:28

Type Values Removed Values Added
References () https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-hg2h-q5h6-r5c4 - () https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-hg2h-q5h6-r5c4 - Exploit, Vendor Advisory
References () https://youtu.be/H_WoqzM-9Cc - () https://youtu.be/H_WoqzM-9Cc - Exploit
CWE CWE-862
CPE cpe:2.3:a:zimaspace:zimaos:*:*:*:*:*:*:*:*
First Time Zimaspace
Zimaspace zimaos

25 Oct 2024, 12:56

Type Values Removed Values Added
Summary
  • (es) ZimaOS es una bifurcación de CasaOS, un sistema operativo para dispositivos Zima y sistemas x86-64 con UEFI. En la versión 1.2.4 y todas las versiones anteriores, los endpoints de API en ZimaOS, como `http:///v1/users/image?path=/var/lib/casaos/1/app_order.json` y `http:///v1/users/image?path=/var/lib/casaos/1/system.json`, exponen datos confidenciales como aplicaciones instaladas e información del sistema sin requerir ninguna autenticación o autorización. Los atacantes pueden aprovechar esta fuga de datos confidenciales para obtener conocimiento detallado sobre la configuración del sistema, las aplicaciones instaladas y otra información crítica. Al momento de la publicación, no hay versiones parcheadas conocidas disponibles.

24 Oct 2024, 22:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-10-24 22:15

Updated : 2024-11-06 15:28


NVD link : CVE-2024-49357

Mitre link : CVE-2024-49357

CVE.ORG link : CVE-2024-49357


JSON object : View

Products Affected

zimaspace

  • zimaos
CWE
CWE-862

Missing Authorization

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor