PT-2020-18338 · Openhab · Openhab

Kaikreuzer · Published 2020-02-20 · Updated 2020-02-26 · CVE-2020-5242

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions openHAB versions prior to 2.5.2

Description The issue allows a remote attacker to use REST calls to install the EXEC binding or EXEC transformation service and execute arbitrary commands on the system with the privileges of the user running openHAB. Starting with version 2.5.2, all commands need to be whitelisted in a local file which cannot be changed via REST calls.

Recommendations For versions prior to 2.5.2, update to version 2.5.2 or later to ensure that commands are whitelisted in a local file and cannot be changed via REST calls. As a temporary workaround, consider restricting access to the REST API to minimize the risk of exploitation.

Fix

Incorrect Authorization

Improper Access Control

Weakness Enumeration

CWE-863

CWE-284

Related Identifiers

CVE-2020-5242

GHSA-W698-693G-23HV

Affected Products

Openhab

References · 5

• https://github.com/openhab/openhab-addons/commit/4c4cb664f2e2c3866aadf117d22fb54aa8dd0031 · Patch
• https://osv.dev/vulnerability/CVE-2020-5242 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5242 · Security Note
• https://github.com/openhab/openhab-addons/security/advisories/GHSA-w698-693g-23hv · Note
• https://t.me/cvenotify/1125 · Telegram Post