id: GO-2024-2615
modules:
    - module: github.com/IceWhaleTech/CasaOS-UserService
      versions:
        - introduced: 0.4.4-3-alpha1
        - fixed: 0.4.7
      vulnerable_at: 0.4.6-alpha3
      packages:
        - package: github.com/IceWhaleTech/CasaOS-UserService/route/v1
          symbols:
            - PutUserInfo
            - PostUserLogin
summary: Username enumeration in github.com/IceWhaleTech/CasaOS-UserService
description: |-
    CasaOS-UserService is vulnerable to a username enumeration issue, when an
    attacker can enumerate the CasaOS username using the application response. If
    the username is incorrect, the application gives the error 'User does not
    exist'. If the password is incorrect, the application gives the error 'Invalid
    password'.
cves:
    - CVE-2024-24766
ghsas:
    - GHSA-c967-2652-gfjm
credits:
    - DrDark1999
references:
    - advisory: https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-c967-2652-gfjm
    - fix: https://github.com/IceWhaleTech/CasaOS-UserService/commit/c75063d7ca5800948e9c09c0a6efe9809b5d39f7
    - web: https://github.com/IceWhaleTech/CasaOS-UserService/releases/tag/v0.4.7
review_status: REVIEWED