PT-2023-28155 · Unknown · Home Assistant

Pwntester · Published 2023-10-19 · Updated 2023-10-26 · CVE-2023-41899

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Home assistant versions prior to 2023.9.0

Description The issue concerns a partial Server-Side Request Forgery vulnerability in the hassio.addon stdin service, where an attacker capable of calling this service may be able to invoke any Supervisor REST API endpoints with a POST request. This could allow the attacker to control the data dictionary, including its addon and input key/values.

Recommendations For versions prior to 2023.9.0, upgrade to version 2023.9.0 or later to address the issue. As a temporary workaround, consider restricting access to the hassio.addon stdin service until the upgrade is possible. Additionally, be cautious when using Supervisor REST API endpoints to minimize the risk of exploitation.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2023-41899

GHSA-4R74-H49Q-RR3H

GHSA-H2JP-7GRC-9XPP

Affected Products

Home Assistant

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41899.json · Exploit
• https://github.com/home-assistant/core/security/advisories/GHSA-4r74-h49q-rr3h · Vendor Advisory
• https://github.com/home-assistant/core/security/advisories/GHSA-h2jp-7grc-9xpp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-41899 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41899 · Security Note
• https://twitter.com/VulmonFeeds/status/1715164718791344314 · Twitter Post
• https://twitter.com/CVEnew/status/1715133136042885201 · Twitter Post
• https://t.me/cvenotify/59769 · Telegram Post