Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS04cDI1LTNxNDYtOHEycM4AA5sM

ESPHome vulnerable to remote code execution via arbitrary file write

Summary

Security misconfiguration in edit configuration file API in dashboard component of ESPHome version 2023.12.9 (command line installation) allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible.

Details

It is possible to abuse this path traversal vulnerability both in command line installation and Home Assistant add-on, but it is possible to read and write files only under the configuration directory.

The vulnerability is present and exploitable in the command line installation, but it was not possible to confirm an impact in the home assistant add-on version.

PoC

Impact

The issue gives read and write access to files under the configuration directory and allows malicious users to write arbitrary code in python scripts executed during the compilation and flashing of firmwares for ESP boards.

If chained with GHSA-9p43-hj5j-96h5 and GHSA-5925-88xh-6h99, this issue could allow an unauthenticated remote user to gain remote code execution on the machine hosting the dashboard.

It also allows accessing sensitive information such as esphome.json and board firmware source code allowing a user to modify the board firmware, and leaking secrets such as: WiFi network credentials, fallback hotspot WiFi credentials, OTA component authentication password and API encryption key.

Credits

Spike Reply Cybersecurity Team

Permalink: https://github.com/advisories/GHSA-8p25-3q46-8q2p
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04cDI1LTNxNDYtOHEycM4AA5sM
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 2 months ago
Updated: about 2 months ago


CVSS Score: 7.2
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-8p25-3q46-8q2p, CVE-2024-27081
References: Repository: https://github.com/esphome/esphome
Blast Radius: 12.6

Affected Packages

pypi:esphome
Dependent packages: 0
Dependent repositories: 56
Downloads: 27,802 last month
Affected Version Ranges: = 2023.12.9
Fixed in: 2024.2.1
All affected versions: 2023.12.9
All unaffected versions: 1.10.1, 1.11.0, 1.11.1, 1.11.2, 1.12.0, 1.12.1, 1.12.2, 1.13.0, 1.13.1, 1.13.2, 1.13.3, 1.13.4, 1.13.5, 1.13.6, 1.14.0, 1.14.1, 1.14.2, 1.14.3, 1.14.4, 1.14.5, 1.15.0, 1.15.1, 1.15.2, 1.15.3, 1.16.0, 1.16.1, 1.16.2, 1.17.0, 1.17.1, 1.17.2, 1.18.0, 1.19.0, 1.19.1, 1.19.2, 1.19.3, 1.19.4, 1.20.0, 1.20.1, 1.20.2, 1.20.3, 1.20.4, 2021.8.0, 2021.8.1, 2021.8.2, 2021.9.0, 2021.9.1, 2021.9.2, 2021.9.3, 2021.10.0, 2021.10.1, 2021.10.2, 2021.10.3, 2021.11.0, 2021.11.1, 2021.11.2, 2021.11.3, 2021.11.4, 2021.12.0, 2021.12.1, 2021.12.2, 2021.12.3, 2022.1.0, 2022.1.1, 2022.1.2, 2022.1.3, 2022.1.4, 2022.2.0, 2022.2.1, 2022.2.2, 2022.2.3, 2022.2.4, 2022.2.5, 2022.2.6, 2022.3.0, 2022.3.1, 2022.3.2, 2022.4.0, 2022.5.0, 2022.5.1, 2022.6.0, 2022.6.1, 2022.6.2, 2022.6.3, 2022.8.0, 2022.8.1, 2022.8.2, 2022.8.3, 2022.9.0, 2022.9.1, 2022.9.2, 2022.9.3, 2022.9.4, 2022.10.0, 2022.10.1, 2022.10.2, 2022.11.0, 2022.11.1, 2022.11.2, 2022.11.3, 2022.11.4, 2022.11.5, 2022.12.0, 2022.12.1, 2022.12.2, 2022.12.3, 2022.12.4, 2022.12.5, 2022.12.6, 2022.12.7, 2022.12.8, 2023.2.0, 2023.2.1, 2023.2.2, 2023.2.3, 2023.2.4, 2023.3.0, 2023.3.1, 2023.3.2, 2023.4.0, 2023.4.1, 2023.4.2, 2023.4.3, 2023.4.4, 2023.5.0, 2023.5.1, 2023.5.2, 2023.5.3, 2023.5.4, 2023.5.5, 2023.6.0, 2023.6.1, 2023.6.2, 2023.6.3, 2023.6.4, 2023.6.5, 2023.7.0, 2023.7.1, 2023.8.0, 2023.8.1, 2023.8.2, 2023.8.3, 2023.9.0, 2023.9.1, 2023.9.2, 2023.9.3, 2023.10.0, 2023.10.1, 2023.10.2, 2023.10.3, 2023.10.4, 2023.10.5, 2023.10.6, 2023.11.0, 2023.11.1, 2023.11.2, 2023.11.3, 2023.11.4, 2023.11.5, 2023.11.6, 2023.12.0, 2023.12.1, 2023.12.2, 2023.12.3, 2023.12.4, 2023.12.5, 2023.12.6, 2023.12.7, 2023.12.8, 2024.2.0, 2024.2.1, 2024.2.2, 2024.3.0, 2024.3.1, 2024.3.2, 2024.4.0, 2024.4.1