.. / CVE-2023-27482

Exploit for Home Assistant Supervisor - Authentication Bypass (CVE-2023-27482)

Description:

Home Assistant Supervisor is an open source home automation tool. A remotely exploitable vulnerability bypassing authentication for accessing the Supervisor API through Home Assistant has been discovered.This impacts all Home Assistant installation types that use the Supervisor 2023.01.1 or older. Installation types, like Home Assistant Container (for example Docker), or Home Assistant Core manually in a Python environment, are not affected.

Nuclei Template

View the template here CVE-2023-27482.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2023/CVE-2023-27482.yaml
Copy

References:

https://www.home-assistant.io/blog/2023/03/08/supervisor-security-disclosure/
https://xz.aliyun.com/t/12572
https://github.com/elttam/publications/blob/master/writeups/home-assistant/supervisor-authentication-bypass-advisory.md
https://nvd.nist.gov/vuln/detail/CVE-2023-27482
https://www.elttam.com/blog/pwnassistant/
https://github.com/home-assistant/core/security/advisories/GHSA-2j8f-h4mr-qr25