Cross-Site Request Forgery (CSRF) Vulnerability in ESPHome Allowing Remote Attackers to Bypass Authentication and Perform Operations on Configuration Files

CVE-2024-29019

What is CVE-2024-29019?

ESPHome is a widely used platform for remote control of microcontrollers through home automation systems. A vulnerability exists in the dashboard API endpoints of ESPHome version 2023.12.9, which permits remote attackers to execute Cross-Site Request Forgery (CSRF) attacks against logged-in users. By crafting a malicious web page, an attacker can initiate unauthorized API calls that perform sensitive operations on configuration files, such as creating, editing, or deleting items on behalf of the victim. To exploit this vulnerability, a user must inadvertently visit a compromised site. Furthermore, this flaw can be exploited in conjunction with another known vulnerability (GHSA-9p43-hj5j-96h5/CVE-2024-27287) to potentially achieve full account takeover. Users are advised to upgrade to version 2024.3.0, which addresses this security issue.

References