github - ghsa-8p25-3q46-8q2p

ghsa-8p25-3q46-8q2p

Vulnerability from github

Published

2024-03-01 20:09

Modified

2025-02-07 20:44

Severity ?

7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

ESPHome vulnerable to remote code execution via arbitrary file write

Details

Summary

Security misconfiguration in edit configuration file API in dashboard component of ESPHome version 2023.12.9 (command line installation) allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible.

Details

It is possible to abuse this path traversal vulnerability both in command line installation and Home Assistant add-on, but it is possible to read and write files only under the configuration directory.

The vulnerability is present and exploitable in the command line installation, but it was not possible to confirm an impact in the home assistant add-on version.

PoC

/edit?configuration=/config/.esphome/esphome.json

/edit?configuration=/config/.esphome/build/test01/src/main.cpp (firmware for board named test01)

RCE payload POST request on /edit?configuration=.esphome/platformio/packages/tool-esptoolpy/esptool.py

Arbitrary code execution during ESP board flashing

Impact

The issue gives read and write access to files under the configuration directory and allows malicious users to write arbitrary code in python scripts executed during the compilation and flashing of firmwares for ESP boards.

If chained with GHSA-9p43-hj5j-96h5 and GHSA-5925-88xh-6h99, this issue could allow an unauthenticated remote user to gain remote code execution on the machine hosting the dashboard.

It also allows accessing sensitive information such as esphome.json and board firmware source code allowing a user to modify the board firmware, and leaking secrets such as: WiFi network credentials, fallback hotspot WiFi credentials, OTA component authentication password and API encryption key.

Credits

Spike Reply Cybersecurity Team

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "esphome"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2023.12.9"
            },
            {
              "fixed": "2024.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2023.12.9"
      ]
    }
  ],
  "aliases": [
    "CVE-2024-27081"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-03-01T20:09:19Z",
    "nvd_published_at": "2024-02-26T17:15:10Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nSecurity misconfiguration in edit configuration file API in dashboard component of ESPHome version 2023.12.9 (command line installation) allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible.\n\n### Details\nIt is possible to abuse this path traversal vulnerability both in command line installation and Home Assistant add-on, but it is possible to read and write files only under the configuration directory. \n\nThe vulnerability is present and exploitable in the command line installation, but it was not possible to confirm an impact in the home assistant add-on version.\n\n### PoC\n\u003cimg width=\"482\" alt=\"/edit?configuration=/config/.esphome/esphome.json\" src=\"https://github.com/esphome/esphome/assets/115887876/d2da3180-976e-4bed-b4b9-35ac960a7fb4\"\u003e\n\u003cbr/\u003e\n\n\u003cimg width=\"344\" alt=\"/edit?configuration=/config/.esphome/build/test01/src/main.cpp (firmware for board named test01)\" src=\"https://github.com/esphome/esphome/assets/115887876/707fb6d7-d4a8-461e-bbb7-05382471e925\"\u003e\n\u003cbr/\u003e\n\n\u003cimg width=\"482\" alt=\"RCE payload POST request on /edit?configuration=.esphome/platformio/packages/tool-esptoolpy/esptool.py\" src=\"https://github.com/esphome/esphome/assets/115887876/c6cb28d8-352d-4fea-b77a-705f63be94e3\"\u003e\n\u003cbr/\u003e\n\n\u003cimg width=\"482\" alt=\"Arbitrary code execution during ESP board flashing\" src=\"https://github.com/esphome/esphome/assets/115887876/5eb0f14c-ceb2-4b15-8898-c02c610763d1\"\u003e\n\n\n### Impact\nThe issue gives read and write access to files under the configuration directory and allows malicious users to write arbitrary code in python scripts executed during the compilation and flashing of firmwares for ESP boards. \n\nIf chained with GHSA-9p43-hj5j-96h5 and GHSA-5925-88xh-6h99, this issue could allow an unauthenticated remote user to gain remote code execution on the machine hosting the dashboard.\n\nIt also allows accessing sensitive information such as esphome.json and board firmware source code allowing a user to modify the board firmware, and leaking secrets such as: WiFi network credentials, fallback hotspot WiFi credentials, OTA component authentication password and API encryption key.\n\n### Credits\nSpike Reply Cybersecurity Team",
  "id": "GHSA-8p25-3q46-8q2p",
  "modified": "2025-02-07T20:44:54Z",
  "published": "2024-03-01T20:09:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/esphome/esphome/security/advisories/GHSA-8p25-3q46-8q2p"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27081"
    },
    {
      "type": "WEB",
      "url": "https://github.com/esphome/esphome/commit/d814ed1d4adc71fde47c4df41215bee449884513"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/esphome/esphome"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ESPHome vulnerable to remote code execution via arbitrary file write"
}

CVE-2024-27081 (GCVE-0-2024-27081)

Vulnerability from cvelistv5

Published

2024-02-26 16:29

Modified

2024-08-27 20:29

Severity ?

7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Summary

ESPHome is a system to control your ESP8266/ESP32. A security misconfiguration in the edit configuration file API in the dashboard component of ESPHome version 2023.12.9 (command line installation) allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible. This vulnerability is patched in 2024.2.1.

References

►

URL

Tags

	https://github.com/esphome/esphome/security/advisories/GHSA-8p25-3q46-8q2p	x_refsource_CONFIRM
	https://github.com/esphome/esphome/commit/d814ed1d4adc71fde47c4df41215bee449884513	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	esphome	esphome	Version: = 2023.12.9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:27:57.835Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/esphome/esphome/security/advisories/GHSA-8p25-3q46-8q2p",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/esphome/esphome/security/advisories/GHSA-8p25-3q46-8q2p"
          },
          {
            "name": "https://github.com/esphome/esphome/commit/d814ed1d4adc71fde47c4df41215bee449884513",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/esphome/esphome/commit/d814ed1d4adc71fde47c4df41215bee449884513"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:esphome:esphome:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "esphome",
            "vendor": "esphome",
            "versions": [
              {
                "status": "affected",
                "version": "2023.12.9"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27081",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-14T19:59:57.002691Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-27T20:29:19.155Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "esphome",
          "vendor": "esphome",
          "versions": [
            {
              "status": "affected",
              "version": "= 2023.12.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ESPHome is a system to control your ESP8266/ESP32. A security misconfiguration in the edit configuration file API in the dashboard component of ESPHome version 2023.12.9 (command line installation) allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible.  This vulnerability is patched in 2024.2.1.\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-26T16:29:21.620Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/esphome/esphome/security/advisories/GHSA-8p25-3q46-8q2p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/esphome/esphome/security/advisories/GHSA-8p25-3q46-8q2p"
        },
        {
          "name": "https://github.com/esphome/esphome/commit/d814ed1d4adc71fde47c4df41215bee449884513",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/esphome/esphome/commit/d814ed1d4adc71fde47c4df41215bee449884513"
        }
      ],
      "source": {
        "advisory": "GHSA-8p25-3q46-8q2p",
        "discovery": "UNKNOWN"
      },
      "title": "ESPHome remote code execution via arbitrary file write"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-27081",
    "datePublished": "2024-02-26T16:29:21.620Z",
    "dateReserved": "2024-02-19T14:43:05.991Z",
    "dateUpdated": "2024-08-27T20:29:19.155Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

ghsa-8p25-3q46-8q2p

Vulnerability from github

Summary

Details

PoC

Impact

Credits

CVE-2024-27081 (GCVE-0-2024-27081)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature