{"id":107226,"date":"2023-03-11T06:48:11","date_gmt":"2023-03-11T04:48:11","guid":{"rendered":"https:\/\/prohoster.info\/?p=107226"},"modified":"2023-03-13T12:06:31","modified_gmt":"2023-03-13T10:06:31","slug":"udalyonno-ekspluatiruemaya-uyazvimost-v-platforme-home-assistant","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-platforme-home-assistant","title":{"rendered":"Kaugjuhtimishaavatavus Home Assistant platvormil","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Avatud koduautomaatika platvormil Home Assistant tuvastati kriitiline haavatavus (CVE-2023-27482), mis v\u00f5imaldab \u00fcletada autentimist ja saada t\u00e4isjuurdep\u00e4\u00e4su privileege API-le Supervisor, mille kaudu saab muuta seadeid, installida\/uuendada tarkvara, hallata lisandeid ja varukoopiaid. <\/p>\n

Probleem puudutab paigaldusi, kus kasutatakse komponenti Supervisor ning ilmneb alates selle esimestest versioonidest (alates 2017. aastast). N\u00e4iteks on haavatavus olemas Home Assistant OS ja Home Assistant Supervised keskkondades, kuid ei m\u00f5juta Home Assistant Container (Docker) ja manuaalselt loodud Python-keskkondi, mille p\u00f5hjal on Home Assistant Core. <\/p>\n

Haavatavus on k\u00f5rvaldatud versioonis Home Assistant Supervisor 2023.01.1. Lisaks on kaitse m\u00f6\u00f6da minekuks kaasatud v\u00e4ljalaskesse Home Assistant 2023.3.0. S\u00fcsteemides, kus ei ole v\u00f5imalik uuendust installida haavatavuse blokeerimiseks, saab piirata juurdep\u00e4\u00e4su Home Assistant veebiteenuse v\u00f5rgupordile v\u00e4lisest v\u00f5rkudest. <\/p>\n

Haavatavuse \u00e4ra kasutamise meetodit ei ole veel detailidena kirjeldatud (arendajate hinnangul on ligikaudu kolmandik kasutajatest v\u00e4rskenduse installinud ja paljud s\u00fcsteemid j\u00e4\u00e4vad haavatavaks). Parandatud versioonis on optimeerimise nimel tehtud muudatusi tokenite t\u00f6\u00f6tlemises ja edastatavatest p\u00e4ringutest, samuti on lisatud filtreid SQL-p\u00e4ringute asendamise, «<script>» sildi sisestamise ja teede kasutamise blokeerimiseks, nagu «..\/» ja «\/.\/».
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0434\u043e\u043c\u0430\u0448\u043d\u0435\u0439 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 Home Assistant \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-27482), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 API Supervisor, \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u043d\u043e \u043c\u0435\u043d\u044f\u0442\u044c \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438, \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c\/\u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c \u041f\u041e, \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f\u043c\u0438 \u0438 \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u044b\u043c\u0438 \u043a\u043e\u043f\u0438\u044f\u043c\u0438. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 Supervisor \u0438 \u043f\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430 \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u043f\u0435\u0440\u0432\u044b\u0445 \u0435\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u043e\u0432 (\u0441 2017 \u0433\u043e\u0434\u0430). \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-107226","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kaugt\u00f6\u00f6deldav haavatavus Home Assistant platvormil | ProHoster","description":"Ava kodustatud koduautomaatika platvormis Home Assistant on tuvastatud kriitiline haavatavus (CVE-2023-27482), mis v\u00f5imaldab m\u00f6\u00f6da minna autentimisest ja saada t\u00e4ielik juurdep\u00e4\u00e4s privileegitud API Supervisorile, kaudu.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-platforme-home-assistant","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 Home Assistant | ProHoster","og:description":"\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0434\u043e\u043c\u0430\u0448\u043d\u0435\u0439 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 Home Assistant \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-27482), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 API Supervisor, \u0447\u0435\u0440\u0435\u0437.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-platforme-home-assistant","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-03-11T04:48:11+00:00","article:modified_time":"2023-03-13T10:06:31+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/107226","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=107226"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/107226\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=107226"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=107226"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=107226"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}