{"id":107226,"date":"2023-03-11T06:48:11","date_gmt":"2023-03-11T04:48:11","guid":{"rendered":"https:\/\/prohoster.info\/?p=107226"},"modified":"2023-03-13T12:06:31","modified_gmt":"2023-03-13T10:06:31","slug":"udalyonno-ekspluatiruemaya-uyazvimost-v-platforme-home-assistant","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-platforme-home-assistant","title":{"rendered":"Vulnerabilit\u00e0 sfruttabile da remoto nella piattaforma Home Assistant","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00c8 stata rilevata una vulnerabilit\u00e0 critica (CVE-2023-27482) nella piattaforma di automazione domestica open source Home Assistant, che consente di bypassare l'autenticazione e ottenere accesso completo all'API privilegiata di Supervisor, attraverso la quale \u00e8 possibile modificare le impostazioni, installare\/aggiornare software, gestire componenti aggiuntivi e backup. <\/p>\n

Il problema riguarda le installazioni in cui \u00e8 presente il componente Supervisor e si manifesta fin dai primi rilasci (dal 2017). Ad esempio, la vulnerabilit\u00e0 \u00e8 presente negli ambienti Home Assistant OS e Home Assistant Supervised, ma non colpisce Home Assistant Container (Docker) e ambienti Python creati manualmente basati su Home Assistant Core. <\/p>\n

La vulnerabilit\u00e0 \u00e8 stata corretta nella versione Home Assistant Supervisor 2023.01.1. Inoltre, una soluzione alternativa \u00e8 stata inclusa nella versione di rilascio di Home Assistant 2023.3.0. Nei sistemi in cui non \u00e8 possibile installare l'aggiornamento per bloccare la vulnerabilit\u00e0, si pu\u00f2 limitare l'accesso alla porta di rete del servizio web di Home Assistant da reti esterne. <\/p>\n

Il metodo di sfruttamento della vulnerabilit\u00e0 non \u00e8 ancora dettagliato (secondo gli sviluppatori, circa 1\/3 degli utenti ha installato l'aggiornamento e molti sistemi rimangono vulnerabili). Nella versione corretta, sotto le spoglie di ottimizzazione, sono state apportate modifiche nella gestione dei token e delle richieste proxy, e sono stati aggiunti filtri per bloccare l'inserimento di query SQL, l'inserimento del tag e l'uso di percorsi con '..\\' e '.\/'.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0434\u043e\u043c\u0430\u0448\u043d\u0435\u0439 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 Home Assistant \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-27482), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 API Supervisor, \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u043d\u043e \u043c\u0435\u043d\u044f\u0442\u044c \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438, \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c\/\u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c \u041f\u041e, \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f\u043c\u0438 \u0438 \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u044b\u043c\u0438 \u043a\u043e\u043f\u0438\u044f\u043c\u0438. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 Supervisor \u0438 \u043f\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430 \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u043f\u0435\u0440\u0432\u044b\u0445 \u0435\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u043e\u0432 (\u0441 2017 \u0433\u043e\u0434\u0430). \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-107226","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilit\u00e0 sfruttabile da remoto nella piattaforma Home Assistant | ProHoster","description":"\u00c8 stata rilevata una vulnerabilit\u00e0 critica (CVE-2023-27482) nella piattaforma di automazione domestica open source Home Assistant, che consente di bypassare l'autenticazione e ottenere accesso completo all'API privilegiata di Supervisor, attraverso.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-platforme-home-assistant","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 Home Assistant | ProHoster","og:description":"\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0434\u043e\u043c\u0430\u0448\u043d\u0435\u0439 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 Home Assistant \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-27482), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 API Supervisor, \u0447\u0435\u0440\u0435\u0437.","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-platforme-home-assistant","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-03-11T04:48:11+00:00","article:modified_time":"2023-03-13T10:06:31+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/107226","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=107226"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/107226\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=107226"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=107226"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=107226"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}