Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Arbitrary internal service access via /v1/sys/proxy when Cloudflare Tunnel is enabled on ZimaOS
Vulnerability Description
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. Prior to version 1.5.3, a proxy endpoint (/v1/sys/proxy) exposed by ZimaOS's web interface can be abused (via an externally reachable domain using a Cloudflare Tunnel) to make requests to internal localhost services. This results in unauthenticated access to internal-only endpoints and sensitive local services when the product is reachable from the Internet through a Cloudflare Tunnel. This issue has been patched in version 1.5.3.
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Vulnerability Type
服务端请求伪造(SSRF)
Vulnerability Title
ZimaOS 代码问题漏洞
Vulnerability Description
ZimaOS是IceWhaleTech的一个开源的操作系统项目，旨在提供一个轻量级、高性能、安全的操作系统环境。 ZimaOS 1.5.3之前版本存在代码问题漏洞，该漏洞源于Web界面暴露的代理端点可能被滥用，向内部本地主机服务发起请求，可能导致当产品通过Cloudflare Tunnel可从互联网访问时，未经验证即可访问内部端点和敏感本地服务。
CVSS Information
N/A
Vulnerability Type
N/A