Home Assistant up to 2023.12.2 Login Page information disclosure

Summaryinfo

A vulnerability identified as problematic has been detected in Home Assistant up to 2023.12.2. Affected by this issue is some unknown functionality of the component Login Page. The manipulation leads to information disclosure. This vulnerability is uniquely identified as CVE-2023-50715. The attack can only be initiated within the local network. Moreover, an exploit is present. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Home Assistant up to 2023.12.2 and classified as problematic. This issue affects some unknown functionality of the component Login Page. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

Home Assistant is open source home automation software. Prior to version 2023.12.3, the login page discloses all active user accounts to any unauthenticated browsing request originating on the Local Area Network. Version 2023.12.3 contains a patch for this issue. When starting the Home Assistant 2023.12 release, the login page returns all currently active user accounts to browsing requests from the Local Area Network. Tests showed that this occurs when the request is not authenticated and the request originated locally, meaning on the Home Assistant host local subnet or any other private subnet. The rationale behind this is to make the login more user-friendly and an experience better aligned with other applications that have multiple user-profiles. However, as a result, all accounts are displayed regardless of them having logged in or not and for any device that navigates to the server. This disclosure is mitigated by the fact that it only occurs for requests originating from a LAN address. But note that this applies to the local subnet where Home Assistant resides and to any private subnet that can reach it.

The weakness was disclosed 12/15/2023 as GHSA-jqpc-rc7g-vf83. The advisory is shared at github.com. The identification of this vulnerability is CVE-2023-50715 since 12/11/2023. Technical details are unknown but a public exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

The exploit is available at github.com. It is declared as proof-of-concept.

Upgrading to version 2023.12.3 eliminates this vulnerability. Applying the patch dbfc5ea8f96bde6cd165892f5a6a6f9a65731c76 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Home Assistant

Version

• 2023.12.0
• 2023.12.1
• 2023.12.2

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Duplicate

• Submit #XXXXXX: Xxxx Xxxx Xxxx Xxxxxxxxx Xxxx Xxxx.xx.x Xxxxxxxxxxx Xxxxxxxxxx

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion