ESPHome vulnerable to remote code execution via arbitrary file write
Summary
Security misconfiguration in edit configuration file API in dashboard component of ESPHome version 2023.12.9 (command line installation) allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible.
Details
It is possible to abuse this path traversal vulnerability both in command line installation and Home Assistant add-on, but it is possible to read and write files only under the configuration directory.
The vulnerability is present and exploitable in the command line installation, but it was not possible to confirm an impact in the home assistant add-on version.
PoC
<img width="482" alt="/edit?configuration=/config/.esphome/esphome.json" src="https://github.com/esphome/esphome/assets/115887876/d2da3180-976e-4bed-b4b9-35ac960a7fb4"> <br/> <img width="344" alt="/edit?configuration=/config/.esphome/build/test01/src/main.cpp (firmware for board named test01)" src="https://github.com/esphome/esphome/assets/115887876/707fb6d7-d4a8-461e-bbb7-05382471e925"> <br/> <img width="482" alt="RCE payload POST request on /edit?configuration=.esphome/platformio/packages/tool-esptoolpy/esptool.py" src="https://github.com/esphome/esphome/assets/115887876/c6cb28d8-352d-4fea-b77a-705f63be94e3"> <br/> <img width="482" alt="Arbitrary code execution during ESP board flashing" src="https://github.com/esphome/esphome/assets/115887876/5eb0f14c-ceb2-4b15-8898-c02c610763d1">Impact
The issue gives read and write access to files under the configuration directory and allows malicious users to write arbitrary code in python scripts executed during the compilation and flashing of firmwares for ESP boards.
If chained with GHSA-9p43-hj5j-96h5 and GHSA-5925-88xh-6h99, this issue could allow an unauthenticated remote user to gain remote code execution on the machine hosting the dashboard.
It also allows accessing sensitive information such as esphome.json and board firmware source code allowing a user to modify the board firmware, and leaking secrets such as: WiFi network credentials, fallback hotspot WiFi credentials, OTA component authentication password and API encryption key.
Credits
Spike Reply Cybersecurity Team
Betroffene Software
Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.
| Plattform | Paket | Anfällige Versionen | Behoben in |
|---|---|---|---|
| Python (PyPI) | esphome | >= 2023.12.9, < 2024.2.1 | 2024.2.1 |
Verweise
- https://github.com/esphome/esphome/security/advisories/GHSA-8p25-3q46-8q2p
- https://nvd.nist.gov/vuln/detail/CVE-2024-27081
- https://github.com/esphome/esphome/commit/d814ed1d4adc71fde47c4df41215bee449884513
- https://github.com/esphome/esphome
- https://pypi.org/project/esphome
- https://github.com/advisories/GHSA-8p25-3q46-8q2p
- CVSS-Vektor
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H- Schwäche (CWE)
CWE-22- Plattform
- Python (PyPI)
- Paket
esphome- Veröffentlicht
- 01.03.2024
- Aktualisiert
- 11.10.2026 15:17
Quellen und Lizenzen
OSV / GitHub Advisory Database - PYSEC-2026-1328 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-8p25-3q46-8q2p - CC BY 4.0
Schwachstellenhistorie: esphome
Alle veröffentlichten Schwachstellen dieses Pakets (Python (PyPI)), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.
- Einträge insgesamt
- 6
- Erste → letzte
- 09.2021 01.2026
- Ohne Fix
- 0
- In Angriffen ausgenutzt
- 0
Verteilung nach Schweregrad
- Hoch 4
- Mittel 2
Veröffentlichungen pro Jahr
- 2021: 1
- 2022: 0
- 2023: 0
- 2024: 3
- 2025: 1
- 2026: 1
-
ESPHome vulnerable to remote code execution via arbitrary file write dieser Eintrag
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.