CVE-2023-37469 (published 2023-08-24T23:15Z)

CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connect to a controlled SMB server, they are able to execute arbitrary commands. Version 0.4.4 contains a patch for the issue.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-77
cwe_name: Improper Neutralization of Special Elements used in a Command ('Command Injection')
description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
extended_description: 
            Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
         
         

Fix information:
repo_url: https://github.com/IceWhaleTech/CasaOS
commit_details: repo_url: https://github.com/IceWhaleTech/CasaOS
author: link
author_date: 2023-04-24 11:24:22+08:00
msg: Update samba (#1021)
repository: repo_url: https://github.com/IceWhaleTech/CasaOS
repo_name: IceWhaleTech/CasaOS
description: CasaOS - A simple, easy-to-use, elegant open-source Personal Cloud system.
repo_language: Go
owner: IceWhaleTech
file_changes: filename: samba.go
change_type: ModificationType.MODIFY
diff: @@ -16,7 +16,6 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
-	"regexp"
 	"strings"
 
 	"github.com/IceWhaleTech/CasaOS-Common/utils/logger"
@@ -27,7 +26,6 @@ import (
 	"github.com/IceWhaleTech/CasaOS/pkg/samba"
 	"github.com/IceWhaleTech/CasaOS/pkg/utils/common_err"
 	"github.com/IceWhaleTech/CasaOS/pkg/utils/file"
-	"github.com/IceWhaleTech/CasaOS/pkg/utils/ip_helper"
 	"github.com/IceWhaleTech/CasaOS/service"
 	model2 "github.com/IceWhaleTech/CasaOS/service/model"
 	"github.com/gin-gonic/gin"
@@ -139,22 +137,22 @@ func PostSambaConnectionsCreate(c *gin.Context) {
 		return
 	}
 
-	if ok, _ := regexp.MatchString(`^[\w@#*.]{4,30}$`, connection.Password); !ok {
-		c.JSON(common_err.CLIENT_ERROR, model.Result{Success: common_err.CHARACTER_LIMIT, Message: common_err.GetMsg(common_err.CHARACTER_LIMIT)})
-		return
-	}
-	if ok, _ := regexp.MatchString(`^[\w@#*.]{4,30}$`, connection.Username); !ok {
-		c.JSON(common_err.CLIENT_ERROR, model.Result{Success: common_err.INVALID_PARAMS, Message: common_err.GetMsg(common_err.INVALID_PARAMS)})
-		return
-	}
-	if !ip_helper.IsIPv4(connection.Host) && !ip_helper.IsIPv6(connection.Host) {
-		c.JSON(common_err.CLIENT_ERROR, model.Result{Success: common_err.INVALID_PARAMS, Message: common_err.GetMsg(common_err.INVALID_PARAMS)})
-		return
-	}
-	if ok, _ := regexp.MatchString("^[0-9]{1,6}$", connection.Port); !ok {
-		c.JSON(common_err.CLIENT_ERROR, model.Result{Success: common_err.INVALID_PARAMS, Message: common_err.GetMsg(common_err.INVALID_PARAMS)})
-		return
-	}
+	// if ok, _ := regexp.MatchString(`^[\w@#*.]{4,30}$`, connection.Password); !ok {
+	// 	c.JSON(common_err.CLIENT_ERROR, model.Result{Success: common_err.CHARACTER_LIMIT, Message: common_err.GetMsg(common_err.CHARACTER_LIMIT)})
+	// 	return
+	// }
+	// if ok, _ := regexp.MatchString(`^[\w@#*.]{4,30}$`, connection.Username); !ok {
+	// 	c.JSON(common_err.CLIENT_ERROR, model.Result{Success: common_err.INVALID_PARAMS, Message: common_err.GetMsg(common_err.INVALID_PARAMS)})
+	// 	return
+	// }
+	// if !ip_helper.IsIPv4(connection.Host) && !ip_helper.IsIPv6(connection.Host) {
+	// 	c.JSON(common_err.CLIENT_ERROR, model.Result{Success: common_err.INVALID_PARAMS, Message: common_err.GetMsg(common_err.INVALID_PARAMS)})
+	// 	return
+	// }
+	// if ok, _ := regexp.MatchString("^[0-9]{1,6}$", connection.Port); !ok {
+	// 	c.JSON(common_err.CLIENT_ERROR, model.Result{Success: common_err.INVALID_PARAMS, Message: common_err.GetMsg(common_err.INVALID_PARAMS)})
+	// 	return
+	// }
 
 	connection.Host = strings.Split(connection.Host, "/")[0]
 	// check is exists

programming_language: Go
filename: connections.go
change_type: ModificationType.MODIFY
diff: @@ -11,11 +11,12 @@
 package service
 
 import (
-	"github.com/IceWhaleTech/CasaOS/pkg/config"
-	command2 "github.com/IceWhaleTech/CasaOS/pkg/utils/command"
+	"fmt"
+
 	"github.com/IceWhaleTech/CasaOS/service/model"
 	model2 "github.com/IceWhaleTech/CasaOS/service/model"
 	"github.com/moby/sys/mount"
+	"golang.org/x/sys/unix"
 	"gorm.io/gorm"
 )
 
@@ -26,7 +27,7 @@ type ConnectionsService interface {
 	CreateConnection(connection *model2.ConnectionsDBModel)
 	DeleteConnection(id string)
 	UpdateConnection(connection *model2.ConnectionsDBModel)
-	MountSmaba(username, host, directory, port, mountPoint, password string) string
+	MountSmaba(username, host, directory, port, mountPoint, password string) error
 	UnmountSmaba(mountPoint string) error
 }
 
@@ -56,9 +57,17 @@ func (s *connectionsStruct) DeleteConnection(id string) {
 	s.db.Where("id= ?", id).Delete(&model.ConnectionsDBModel{})
 }
 
-func (s *connectionsStruct) MountSmaba(username, host, directory, port, mountPoint, password string) string {
-	str := command2.ExecResultStr("source " + config.AppInfo.ShellPath + "/helper.sh ;MountCIFS " + username + " " + host + " " + directory + " " + port + " " + mountPoint + " " + password)
-	return str
+func (s *connectionsStruct) MountSmaba(username, host, directory, port, mountPoint, password string) error {
+	err := unix.Mount(
+		fmt.Sprintf("//%s/%s", host, directory),
+		mountPoint,
+		"cifs",
+		unix.MS_NOATIME|unix.MS_NODEV|unix.MS_NOSUID,
+		fmt.Sprintf("username=%s,password=%s", username, password),
+	)
+	return err
+	//str := command2.ExecResultStr("source " + config.AppInfo.ShellPath + "/helper.sh ;MountCIFS " + username + " " + host + " " + directory + " " + port + " " + mountPoint + " " + password)
+	//return str
 }
 func (s *connectionsStruct) UnmountSmaba(mountPoint string) error {
 	return mount.Unmount(mountPoint)

programming_language: Go