Horizon Alert
Summary of the vulnerability and why it matters
A security vulnerability has been identified in openHAB's home automation software, specifically within its CometVisu add-on. This issue could allow unauthorized access to internal systems through Server-Side Request Forgery and Cross-Site Scripting, potentially leading to further exploitation. The primary concern is to confirm if this software is used and exposed in a way that could be affected.
- Unauthenticated access to internal systems.
- Check if openHAB is deployed and exposed externally.
- Assess relevance and exposure of openHAB deployments.
Attack Path
How an attacker could exploit the issue
An attacker can reach this vulnerability by interacting with the CometVisu add-on's proxy endpoint, which is accessible without authentication if openHAB is exposed externally. This can allow the attacker to craft requests that trick the add-on into sending arbitrary GET requests to internal servers, potentially leading to cross-site scripting attacks that execute with the origin of the add-on's user interface. If chained with other vulnerabilities, this could enable remote code execution.
- No authentication required.
- Proxy endpoint triggers vulnerability.
- Risks include SSRF, XSS, and RCE.
Live Threat
Current exploitation, exposure, and threat context
When openHAB's CometVisu add-on is exposed on a non-private network, an unauthenticated attacker could exploit a proxy endpoint to send GET requests to internal servers. This could also lead to cross-site scripting, allowing an attacker to execute JavaScript with the CometVisu UI's origin. This may enable further exploitation, potentially leading to remote code execution when combined with other vulnerabilities.
- Internal network services or data.
- SSRF and XSS attacks on the add-on.
- Compromise of system and user data.
Operational Fix
Recommended remediation, mitigation, and detection steps
The openHAB CometVisu add-on's proxy endpoint is vulnerable to SSRF and XSS attacks, potentially leading to RCE if chained with other vulnerabilities. Given that openHAB is typically deployed in private networks, the immediate first step for technical leaders and system owners is to identify all instances of the affected technology, confirm their network exposure and business criticality, and then assign ownership for remediation planning.
- Assign ownership to application or platform teams.
- Verify network exposure and business criticality.
- Plan remediation based on risk assessment.
