homeassistant@2023.4.0b0 vulnerabilities

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) due to missing X-Frame-Options headers. An attacker may trick users into installing an malicious add-ons or perform other unintended actions by exploiting frame functionality.

Upgrade homeassistant to version 2023.9.0b0 or higher.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the login page, which accepts redirect URIs using the javascript: scheme within <link rel="redirect_uri" href="..."> tags on a requested page. An attacker can achieve full account takeover by exploiting this vector.

Upgrade homeassistant to version 2023.9.0 or higher.

Affected versions of this package are vulnerable to Access Restriction Bypass by exposing local_only webhooks to the SniTun proxy via *.ui.nabu.casa URLs, even when the webhook is marked as "Only accessible from the local network".

Upgrade homeassistant to version 2023.9.0b0 or higher.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through 'hassio.addon_stdin', where an attacker capable of calling this service may be able to invoke any Supervisor REST API endpoints with a POST request. An attacker able to exploit will be able to control the data dictionary, including its addon and input key/values.

Upgrade homeassistant to version 2023.9.0 or higher.

Affected versions of this package are vulnerable to Information Exposure due to an issue with the login page, which discloses all active user accounts to any unauthenticated browsing request originating on the Local Area Network. This could potentially allow an unauthorized actor to gain knowledge of all user accounts on the system.

Notes:

This applies to the local subnet where Home Assistant resides and to any private subnet that can reach it.

Upgrade homeassistant to version 2023.12.3 or higher.

Affected versions of this package are vulnerable to Information Exposure Through Sent Data via the redirect_uri and client_id parameters. Consequently, the code parameter utilized to fetch the access_token post-authentication will be sent to the URL specified in the aforementioned parameters.

Note: This is only exploitable if the victim's Home Assistant is exposed to the Internet and the victim authenticates via a link sent by the attacker.

Upgrade homeassistant to version 2023.9.0 or higher.