Smart Home

Disclosure: Supervisor safety vulnerability – House Assistant

By / March 11, 2023

We had been made conscious of a safety subject impacting installations utilizing
the House Assistant Supervisor. A repair for this safety subject has been rolled
out to all affected House Assistant customers through the Supervisor auto-update system
and this subject is now not current.

You may confirm that you simply obtained the replace on the Home Assistant About page
and confirm that you’re operating Supervisor 2023.03.1 or later. If you don’t
see a Supervisor model in your About web page, you don’t use one of many affected
set up sorts and haven’t been susceptible.

The difficulty has additionally been mitigated in House Assistant 2023.3.0. This model
was launched on March 1 and has since been put in by 33% of our users.

Affected version

The security issue affected installation types Home Assistant OS and
Home Assistant Supervised. This includes installations running on the
Home Assistant Blue and Home Assistant Yellow.

The two other installation types, Home Assistant Container (Docker) and
Home Assistant Core (own Python environment), have not been affected.

Credits

The security issue was found by Joseph Surin from elttam. Many thanks for bringing this to our consideration.

About the issue

The Supervisor is an application that is part of Home Assistant OS
and Home Assistant Supervised installations and is responsible for
system management. The issue allowed an attacker to remotely bypass
authentication and interact directly with the Supervisor API. This gives
an attacker access to install Home Assistant updates and manage add-ons
and backups. Our analysis shows that this issue has been in Home Assistant
since the introduction of the Supervisor in 2017.

We have published security advisory CVE-2023-27482 on GitHub.

FAQ

Has this vulnerability been abused?

We don’t know. Now we have not heard any stories of individuals being hacked.

Is there a workaround?

In case one isn’t capable of improve the House Assistant Supervisor or the
House Assistant Core software right now, it’s suggested to not expose
your House Assistant occasion to the web.

Tags: , , , , ,

Latest News