4 ms·
> The issue allowed an attacker to remotely bypass authentication and interact directly with the Supervisor API. This gives an attacker access to install Home A
by ThePowerOfFuet 4y ago
> The issue allowed an attacker to remotely bypass authentication and interact directly with the Supervisor API. This gives an attacker access to install Home Assistant updates and manage add-ons and backups. Our analysis shows that this issue has been in Home Assistant since the introduction of the Supervisor in 2017.
Holy shit.
- haswell 4y agoThis would primarily be a concern if someone decided to expose the machine running HA to the Internet. This is one of the reasons I’ve never used port forwarding for external access to anything run locally. The vulnerability is still bad, but at least only accessible to my home network.
- JJJollyjim 4y agoShodan lists 125,000 HA installs exposed to the internet (though I don't know how accurate that statistic is, nor what fraction have a Supervisor) https://www.shodan.io/search?query=product%3A"Home+Assistant" https://www.shodan.io/search?query=product%3A"Home+Assistant...
- upon_drumhead 4y agoWouldn’t it have to be an exposed supervisor port to the internet? It’s not enough to just be running supervisor and having home assistant exposed, right?
- JJJollyjim 4y agoI don't believe so – from a quick glance it seems that supervisor requests are proxied through the normal HA port, and the supervisor doesn't have it's own port except for the Observer (which seems to be a simple read-only thing).