PT-2023-28152 · Unknown · Home Assistant Core+1
Frenck
·
Published
2023-10-19
·
Updated
2023-10-26
·
CVE-2023-41896
CVSS v3.1
7.1
High
| Vector | AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Home Assistant Core versions prior to 2023.8.0
home-assistant-js-websocket versions prior to 8.2.0
Description
The issue concerns an open-source home automation system where the WebSocket authentication logic is vulnerable to exploitation. Specifically, the
auth callback=1 parameter, in conjunction with the state parameter containing the hassUrl, allows an attacker to create a malicious link that forces the frontend to connect to an alternative WebSocket backend. This enables the attacker to spoof WebSocket responses and trigger cross-site scripting (XSS), potentially leading to a comprehensive takeover scenario. The fact that the site can be iframed by other origins makes the exploit more covert. The audit team found that despite reasonable security hardening, the js url for custom panels could be exploited.Recommendations
For Home Assistant Core versions prior to 2023.8.0, upgrade to version 2023.8.0 or later.
For home-assistant-js-websocket versions prior to 8.2.0, upgrade to version 8.2.0 or later.
As a temporary workaround, consider modifying the WebSocket code’s authentication flow to not trust the
hassUrl passed in by a GET parameter. However, the best course of action is to upgrade to the fixed versions.Exploit
Fix
Insufficient Verification of Data Authenticity
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Home Assistant Core
Home-Assistant-Js-Websocket