CVE-2021-47942

Home Assistant Community Store 1.10.0 Path Traversal Account Takeover

CVSS 8.7 HIGHEPSS 0.5%CWE-22

Home Assistant Community Store (HACS) prior to 1.10.0 contains a path traversal vulnerability that allows unauthenticated attackers to read sensitive files by traversing directories via the /hacsfiles/ endpoint. Attackers can retrieve the .storage/auth file containing user credentials and refresh tokens, then craft valid JWT tokens to gain administrative access to Home Assistant instances.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Affected products

Home-Assistant · Home Assistant Community Store (HACS)

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/49495unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/hacs/integration https://www.exploit-db.com/exploits/49495 https://www.home-assistant.io/https://www.vulncheck.com/advisories/home-assistant-community-store-path-traversal-account-takeover