Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS01OTI1LTg4eGgtNmg5Oc4AA6NN

ESPHome vulnerable to Authentication bypass via Cross site request forgery

Summary

API endpoints in dashboard component of ESPHome version 2023.12.9 (command line installation) are vulnerable to Cross-Site Request Forgery (CSRF) allowing remote attackers to carry out attacks against a logged user of the dashboard to perform operations on configuration files (create, edit, delete).

Details

It is possible for a malicious actor to create a specifically crafted web page that triggers a cross site request against ESPHome, this allows bypassing the authentication for API calls on the platform.

PoC

An example of malicious web page that abuses this vulnerability:

<script>
document.forms[0].submit();
</script>

<script>
</script>

In which an attacker creates and weaponizes "poc.yaml" config file containing a cookie exfiltration script and forces the payload triggering visiting the vulnerable page.

Example of such script:

Impact

This vulnerability allows bypassing authentication on API calls accessing configuration file operations on the behalf of a logged user. In order to trigger the vulnerability, the victim must visit a weaponized page.

In addition to this, it is possible to chain this vulnerability with GHSA-9p43-hj5j-96h5 (as seen in the PoC) to obtain a complete takeover of the user account.

Permalink: https://github.com/advisories/GHSA-5925-88xh-6h99
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01OTI1LTg4eGgtNmg5Oc4AA6NN
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 9 months ago
Updated: 7 months ago

CVSS Score: 8.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Identifiers: GHSA-5925-88xh-6h99, CVE-2024-29019
References:

• https://github.com/esphome/esphome/security/advisories/GHSA-5925-88xh-6h99
• https://github.com/advisories/GHSA-9p43-hj5j-96h5
• https://github.com/esphome/esphome/pull/6396
• https://github.com/esphome/esphome/pull/6397
• https://github.com/esphome/esphome/commit/c56c40cb824e34ed2b89ba1cb8a3a5eb31459c74
• https://github.com/esphome/esphome/releases/tag/2024.3.0
• https://nvd.nist.gov/vuln/detail/CVE-2024-29019
• https://github.com/advisories/GHSA-5925-88xh-6h99

Repository: https://github.com/esphome/esphome
Blast Radius: 14.2

Affected Packages