id: GO-2024-2668
modules:
    - module: github.com/IceWhaleTech/CasaOS-UserService
      versions:
        - fixed: 0.4.8
      vulnerable_at: 0.4.7
      packages:
        - package: github.com/IceWhaleTech/CasaOS-UserService/route/v1
          symbols:
            - PostUserLogin
summary: Login username enumeration in github.com/IceWhaleTech/CasaOS-UserService
description: |-
    The Casa OS Login page has a username enumeration vulnerability in the login
    page that was patched in Casa OS v0.4.7. The issue exists because the
    application response differs depending on whether the username or password is
    incorrect, allowing an attacker to enumerate usernames by observing the
    application response. For example, if the username is incorrect, the application
    returns "User does not exist" with return code "10006", while if the password is
    incorrect, it returns "User does not exist or password is invalid" with return
    code "10013". This allows an attacker to determine if a username exists without
    knowing the password.
cves:
    - CVE-2024-28232
ghsas:
    - GHSA-hcw2-2r9c-gc6p
credits:
    - DrDark1999
references:
    - fix: https://github.com/IceWhaleTech/CasaOS-UserService/commit/dd927fe1c805e53790f73cfe10c7a4ded3bc5bdb