CVE-2024-27287

Advisory

Affected versions of the esphome package are vulnerable to Cross-Site Scripting (XSS) due to unsanitized content being served with an HTML content type. The /edit endpoint in the dashboard component allows a remote authenticated user to inject arbitrary JavaScript into configuration files without sanitization, and that script is subsequently rendered with `Content-Type: text/html; charset=UTF-8`. An attacker who is authenticated can craft a POST to `/edit?configuration=[file]` that includes a malicious script and then have a victim visit `/edit?configuration=[file]`, enabling exfiltration of session cookies and unauthorized operations such as reading, editing, deleting configuration files and flashing firmware on managed boards.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/esphome/esphome/security/advisories/GHSA-9p43-hj5j-96h5
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27287