{"id":107226,"date":"2023-03-11T06:48:11","date_gmt":"2023-03-11T04:48:11","guid":{"rendered":"https:\/\/prohoster.info\/?p=107226"},"modified":"2023-03-13T12:06:31","modified_gmt":"2023-03-13T10:06:31","slug":"udalyonno-ekspluatiruemaya-uyazvimost-v-platforme-home-assistant","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-platforme-home-assistant","title":{"rendered":"Vuln\u00e9rabilit\u00e9 exploit\u00e9e \u00e0 distance dans la plateforme Home Assistant","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Une vuln\u00e9rabilit\u00e9 critique a \u00e9t\u00e9 identifi\u00e9e dans la plateforme d'automatisation domestique open source Home Assistant (CVE-2023-27482), permettant de contourner l'authentification et d'obtenir un acc\u00e8s complet \u00e0 l'API privil\u00e9gi\u00e9e du Supervisor, gr\u00e2ce \u00e0 laquelle il est possible de modifier les param\u00e8tres, d'installer\/mettre \u00e0 jour des logiciels, de g\u00e9rer les modules compl\u00e9mentaires et de r\u00e9aliser des sauvegardes. <\/p>\n

Le probl\u00e8me concerne les installations utilisant le composant Supervisor et est pr\u00e9sent depuis ses premi\u00e8res versions (depuis 2017). Par exemple, la vuln\u00e9rabilit\u00e9 est pr\u00e9sente dans les environnements Home Assistant OS et Home Assistant Supervised, mais ne concerne pas Home Assistant Container (Docker) et les environnements Python cr\u00e9\u00e9s manuellement bas\u00e9s sur Home Assistant Core. <\/p>\n

La vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 corrig\u00e9e dans la version Home Assistant Supervisor 2023.01.1. De plus, une solution de contournement a \u00e9t\u00e9 incluse dans la version Home Assistant 2023.3.0. Sur les syst\u00e8mes o\u00f9 la mise \u00e0 jour pour bloquer la vuln\u00e9rabilit\u00e9 ne peut pas \u00eatre install\u00e9e, l'acc\u00e8s au port r\u00e9seau du service web Home Assistant peut \u00eatre restreint depuis les r\u00e9seaux externes. <\/p>\n

La m\u00e9thode d'exploitation de la vuln\u00e9rabilit\u00e9 n'est pas encore d\u00e9taill\u00e9e (selon les d\u00e9veloppeurs, environ 1\/3 des utilisateurs ont install\u00e9 la mise \u00e0 jour et de nombreux syst\u00e8mes restent vuln\u00e9rables). Dans la version corrig\u00e9e, des modifications ont \u00e9t\u00e9 apport\u00e9es au traitement des jetons et des requ\u00eates proxy sous le pr\u00e9texte d'optimisation, ainsi que l'ajout de filtres pour bloquer l'injection de requ\u00eates SQL, l'insertion de la balise et l'utilisation de chemins avec '..\/' et '\/.'.
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0434\u043e\u043c\u0430\u0448\u043d\u0435\u0439 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 Home Assistant \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-27482), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 API Supervisor, \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u043d\u043e \u043c\u0435\u043d\u044f\u0442\u044c \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438, \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c\/\u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c \u041f\u041e, \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f\u043c\u0438 \u0438 \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u044b\u043c\u0438 \u043a\u043e\u043f\u0438\u044f\u043c\u0438. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 Supervisor \u0438 \u043f\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430 \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u043f\u0435\u0440\u0432\u044b\u0445 \u0435\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u043e\u0432 (\u0441 2017 \u0433\u043e\u0434\u0430). \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-107226","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vuln\u00e9rabilit\u00e9 exploitable \u00e0 distance dans la plateforme Home Assistant | ProHoster","description":"Une vuln\u00e9rabilit\u00e9 critique a \u00e9t\u00e9 identifi\u00e9e dans la plateforme d'automatisation domestique open source Home Assistant (CVE-2023-27482), permettant de contourner l'authentification et d'obtenir un acc\u00e8s complet \u00e0 l'API privil\u00e9gi\u00e9e du Supervisor.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-platforme-home-assistant","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 Home Assistant | ProHoster","og:description":"\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0434\u043e\u043c\u0430\u0448\u043d\u0435\u0439 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 Home Assistant \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-27482), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 API Supervisor, \u0447\u0435\u0440\u0435\u0437.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-platforme-home-assistant","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-03-11T04:48:11+00:00","article:modified_time":"2023-03-13T10:06:31+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/107226","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=107226"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/107226\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=107226"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=107226"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=107226"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}