CVE-2023-41894 Local-only webhooks externally accessible via SniTun in Home Assistant Core
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2023-41894?
CVE-2023-41894 is a medium-severity vulnerability in home-assistant core, published on 19 Oct 2023.
Official description
Home assistant is an open source home automation. The assessment verified that webhooks available in the webhook component are triggerable via the `*.ui.nabu.casa` URL without authentication, even when the webhook is marked as Only accessible from the local network. This issue is facilitated by the SniTun proxy, which sets the source address to 127.0.0.1 on all requests sent to the public URL and forwarded to the local Home Assistant. This issue has been addressed in version 2023.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-669
Which versions are affected by CVE-2023-41894?
It affects 1 product.
Products include Home-Assistant Home-Assistant.
How do I fix CVE-2023-41894?
No fix has been published for CVE-2023-41894 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-41894 being exploited?
There is no known exploitation of CVE-2023-41894 in the wild and no public exploit code.
Other vulnerabilities in home-assistant core
- CVE-2023-27482 Auth bypass in core
- CVE-2023-41895 Cross-site Scripting via auth_callback login in Home Assistant Core
- CVE-2023-41897 Lack of XFO header allows clickjacking in Home Assistant Core
- CVE-2026-54317 Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
- CVE-2020-36517 Information disclosure in n/a
Sources
Also known as GHSA-wx3j-3v2j-rf45.