ZimaOS Arbitrary File Read via Parameter Manipulation

CVE-2024-48931

What is CVE-2024-48931?

ZimaOS, a fork of CasaOS designed for Zima devices and x86-64 systems with UEFI, contains a significant vulnerability in its API. Inversions 1.2.4 and earlier, the API endpoint, located at http://<Zima_Server_IP:PORT>/v3/file?token=<token>&files=<file_path>, suffers from inadequate input validation, leading to arbitrary file reading. By manipulating the files parameter, authenticated users can access sensitive system files such as /etc/shadow, which contains hashed passwords for all users on the system. This flaw is particularly dangerous as it could enable attackers to escalate privileges or compromise the system. This vulnerability arises from the API endpoint's failure to properly validate or restrict file paths submitted in the files parameter, enabling successful exploitation. As of the latest updates, no patched versions of ZimaOS have been released.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References