PT-2023-28149 · Unknown · Home Assistant

Frenck

·

Published

2023-10-19

·

Updated

2023-10-26

·

CVE-2023-41893

CVSS v3.1

5.4

Medium

VectorAV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Home Assistant versions prior to 2023.9.0
Description The issue concerns the alterability of the redirect uri and client id when logging in to Home Assistant, an open-source home automation system. This allows an attacker to manipulate a user and retrieve account access by sending a link with a controlled redirect uri to the victim's Home Assistant instance. If the victim authenticates via this link, the attacker can obtain the code sent to the specified URL in redirect uri and leverage it to fetch an access token. The attack strategy is plausible if the victim has exposed their Home Assistant to the Internet. An attacker could increase the efficacy of this strategy by registering a nearly identical domain to homeassistant.local, which may appear legitimate and obfuscate malicious intentions.
Recommendations To resolve the issue, upgrade to version 2023.9.0 or later. As a temporary workaround, consider restricting access to the redirect uri parameter to minimize the risk of exploitation. Avoid using the redirect uri parameter in the affected login endpoint until the issue is resolved. Restrict access to the Home Assistant instance from the Internet to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

Related Identifiers

CVE-2023-41893
GHSA-QHHJ-7HRC-GQJ5
PYSEC-2023-214

Affected Products

Home Assistant