CVE-2024-27081: ESPHome remote code execution via arbitrary file write
Summary Security misconfiguration in edit configuration file API in dashboard component of ESPHome version 2023.12.9 (command line installation) allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible.
Details It is possible to abuse this path traversal vulnerability both in command line installation and Home Assistant add-on, but it is possible to read and write files only under the configuration directory.
The vulnerability is present and exploitable in the command line installation, but it was not possible to confirm an impact in the home assistant add-on version.
PoC <img width="482" alt="/edit?configuration=/config/.esphome/esphome.json" src="https://github.com/esphome/esphome/assets/115887876/d2da3180-976e-4bed-b4b9-35ac960a7fb4"> <br/>
<img width="344" alt="/edit?configuration=/config/.esphome/build/test01/src/main.cpp (firmware for board named test01)" src="https://github.com/esphome/esphome/assets/115887876/707fb6d7-d4a8-461e-bbb7-05382471e925"> <br/>
<img width="482" alt="RCE payload POST request on /edit?configuration=.esphome/platformio/packages/tool-esptoolpy/esptool.py" src="https://github.com/esphome/esphome/assets/115887876/c6cb28d8-352d-4fea-b77a-705f63be94e3"> <br/>
<img width="482" alt="Arbitrary code execution during ESP board flashing" src="https://github.com/esphome/esphome/assets/115887876/5eb0f14c-ceb2-4b15-8898-c02c610763d1">
Impact The issue gives read and write access to files under the configuration directory and allows malicious users to write arbitrary code in python scripts executed during the compilation and flashing of firmwares for ESP boards.
If chained with GHSA-9p43-hj5j-96h5 and GHSA-5925-88xh-6h99, this issue could allow an unauthenticated remote user to gain remote code execution on the machine hosting the dashboard.
It also allows accessing sensitive information such as esphome.json and board firmware source code allowing a user to modify the board firmware, and leaking secrets such as: WiFi network credentials, fallback hotspot WiFi credentials, OTA component authentication password and API encryption key.
Credits Spike Reply Cybersecurity Team
Other sources
ESPHome is a system to control your ESP8266/ESP32. A security misconfiguration in the edit configuration file API in the dashboard component of ESPHome version 2023.12.9 (command line installation) allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible. This vulnerability is patched in 2024.2.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/esphometo a version that resolves this vulnerability.Fixed in 2024.2.1 - Upgrade
Upgrade
esphome/esphometo a version that resolves this vulnerability.Fixed in 2024.2.1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27081?
CVE-2024-27081 is classified as a high severity vulnerability due to the potential for remote code execution.
How do I fix CVE-2024-27081?
To fix CVE-2024-27081, upgrade the ESPHome package to version 2024.2.1 or later.
What types of attacks can exploit CVE-2024-27081?
CVE-2024-27081 can be exploited by authenticated remote attackers to read and write arbitrary files.
Which versions of ESPHome are affected by CVE-2024-27081?
CVE-2024-27081 affects ESPHome version 2023.12.9.
What components are involved in CVE-2024-27081?
CVE-2024-27081 involves a security misconfiguration in the edit configuration file API of the dashboard component.