PT-2024-22673 · Esphome · Esphome

Highjesserockz · Published 2024-03-06 · Updated 2024-04-11 · CVE-2024-29019

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ESPHome versions 2023.12.9 through 2024.2.x ESPHome version 2023.12.9

Description The dashboard component of ESPHome contains API endpoints that are vulnerable to Cross-Site Request Forgery (CSRF), allowing remote attackers to carry out attacks against a logged user of the dashboard to perform operations on configuration files, such as create, edit, and delete. A malicious actor can create a specifically crafted web page that triggers a cross-site request against ESPHome, bypassing the authentication for API calls on the platform. This issue can be chained with another vulnerability to obtain a complete takeover of the user account. The victim must visit a weaponized page to trigger the vulnerability.

Recommendations For ESPHome version 2023.12.9, update to version 2024.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the dashboard component to minimize the risk of exploitation. Avoid using the dashboard component until the issue is resolved.

Exploit

Fix

XSS

CSRF

Weakness Enumeration

CWE-79

CWE-352

Related Identifiers

CVE-2024-29019

GHSA-5925-88XH-6H99

GHSA-9P43-HJ5J-96H5

Affected Products

Esphome

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29019.json · Exploit
• https://osv.dev/vulnerability/GHSA-5925-88xh-6h99 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-29019 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-29019 · Security Note
• https://osv.dev/vulnerability/GHSA-9p43-hj5j-96h5 · Vendor Advisory
• https://github.com/esphome/esphome · Note
• https://github.com/esphome/esphome/commit/37d2b3c7977a4ccbec59726ca7549cb776661455 · Note
• https://github.com/esphome/esphome/security/advisories/GHSA-9p43-hj5j-96h5 · Note
• https://github.com/esphome/esphome/security/advisories/GHSA-5925-88xh-6h99 · Note
• https://github.com/esphome/esphome/pull/6397 · Note
• https://github.com/esphome/esphome/commit/c56c40cb824e34ed2b89ba1cb8a3a5eb31459c74 · Note
• https://github.com/esphome/esphome/releases/tag/2024.3.0 · Note
• https://github.com/esphome/esphome/pull/6396 · Note
• https://twitter.com/CVEnew/status/1770848026342375592 · Twitter Post
• https://github.com/advisories/GHSA-9p43-hj5j-96h5 · Note