nvd-json-data-feeds/CVE-2024/CVE-2024-424xx/CVE-2024-42467.json

{
  "id": "CVE-2024-42467",
  "sourceIdentifier": "security-advisories@github.com",
  "published": "2024-08-12T13:38:34.740",
  "lastModified": "2024-08-29T16:26:43.947",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Prior to version 4.2.1, the proxy endpoint of openHAB's CometVisu add-on can be accessed without authentication. This proxy-feature can be exploited as Server-Side Request Forgery (SSRF) to induce GET HTTP requests to internal-only servers, in case openHAB is exposed in a non-private network. Furthermore, this proxy-feature can also be exploited as a Cross-Site Scripting (XSS) vulnerability, as an attacker is able to re-route a request to their server and return a page with malicious JavaScript code. Since the browser receives this data directly from the openHAB CometVisu UI, this JavaScript code will be executed with the origin of the CometVisu UI. This allows an attacker to exploit call endpoints on an openHAB server even if the openHAB server is located in a private network. (e.g. by sending an openHAB admin a link that proxies malicious JavaScript.) This issue may lead up to Remote Code Execution (RCE) when chained with other vulnerabilities. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to receive a patch."
    },
    {
      "lang": "es",
      "value": "openHAB, un proveedor de software de automatizaci\u00f3n del hogar de c\u00f3digo abierto, tiene complementos que incluyen el complemento de visualizaci\u00f3n CometVisu. Antes de la versi\u00f3n 4.2.1, se pod\u00eda acceder al extremo proxy del complemento CometVisu de openHAB sin autenticaci\u00f3n. Esta caracter\u00edstica de proxy se puede explotar como Server-Side Request Forgery (SSRF) para inducir solicitudes GET HTTP a servidores solo internos, en caso de que openHAB est\u00e9 expuesto en una red no privada. Adem\u00e1s, esta caracter\u00edstica de proxy tambi\u00e9n se puede explotar como una vulnerabilidad de cross site scripting (XSS), ya que un atacante puede redirigir una solicitud a su servidor y devolver una p\u00e1gina con c\u00f3digo JavaScript malicioso. Dado que el navegador recibe estos datos directamente desde la interfaz de usuario de openHAB CometVisu, este c\u00f3digo JavaScript se ejecutar\u00e1 con el origen de la interfaz de usuario de CometVisu. Esto permite a un atacante explotar los endpoints de llamadas en un servidor openHAB incluso si el servidor openHAB est\u00e1 ubicado en una red privada. (por ejemplo, enviando a un administrador de openHAB un enlace que representa JavaScript malicioso). Este problema puede provocar una ejecuci\u00f3n remota de c\u00f3digo (RCE) cuando se combina con otras vulnerabilidades. Los usuarios deben actualizar a la versi\u00f3n 4.2.1 del complemento CometVisu de openHAB para recibir un parche."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "security-advisories@github.com",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.8
      },
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.0
      }
    ]
  },
  "weaknesses": [
    {
      "source": "security-advisories@github.com",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    },
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:openhab:openhab_web_interface:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "4.2.1",
              "matchCriteriaId": "CD354FE1-98C9-493C-BCF6-4DAFC179459E"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/openhab/openhab-webui/blob/1c03c60f84388b9d7da0231df2d4ebb1e17d3fcf/bundles/org.openhab.ui.cometvisu/src/main/java/org/openhab/ui/cometvisu/internal/backend/rest/ProxyResource.java#L83",
      "source": "security-advisories@github.com",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://github.com/openhab/openhab-webui/commit/630e8525835c698cf58856aa43782d92b18087f2",
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/openhab/openhab-webui/security/advisories/GHSA-v7gr-mqpj-wwh3",
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}