{"answers":{"affected":"3 open source packages ship an affected version, including esphome. It affects 1 product.","exploited":"There is no known exploitation of CVE-2024-27287 in the wild and no public exploit code.","fix":"Upgrade esphome to 2024.2.2 or later.","what":"CVE-2024-27287 is a medium-severity cross-site scripting vulnerability in esphome, published on 6 Mar 2024. An attacker needs administrator access to exploit it, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-27287 and fix it if it is affected.\n\nWhat it is: CVE-2024-27287 is a medium-severity cross-site scripting vulnerability in esphome, published on 6 Mar 2024. An attacker needs administrator access to exploit it, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2024-27287 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- esphome (PyPI): affected from 2023.12.9; fixed in 2024.2.2\n- esphome (PyPI): affected from 2023.12.9; fixed in 2024.2.2\n- esphome (PyPI): affected from 2023.12.9; fixed in 2024.2.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-27287/ (Markdown: https://insights.sbomify.com/CVE-2024-27287/index.md)","id":"CVE-2024-27287","markdown":"https://insights.sbomify.com/CVE-2024-27287/index.md","name":"CVE-2024-27287","record":{"aliases":["GHSA-9p43-hj5j-96h5","PYSEC-2026-1329"],"analysis":{"component_type":"iot_embedded","fix_type":"upgrade","impacts":["account_takeover","data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Home automation firmware","requires_auth":"high_privilege","summary":"Authenticated attackers can inject scripts into ESPHome dashboard configuration files to steal session cookies and perform actions on behalf of victims.","user_interaction":"not_required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"esphome","vendor":"esphome"}],"cvss":{"score":6.5,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"description":"ESPHome is a system to control your ESP8266/ESP32 for Home Automation systems. Starting in version 2023.12.9 and prior to version 2024.2.2, editing the configuration file API in dashboard component of ESPHome version 2023.12.9 (command line installation and Home Assistant add-on) serves unsanitized data with `Content-Type: text/html; charset=UTF-8`, allowing a remote authenticated user to inject arbitrary web script and exfiltrate session cookies via Cross-Site scripting. It is possible for a malicious authenticated user to inject arbitrary Javascript in configuration files using a POST request to the /edit endpoint, the configuration parameter allows to specify the file to write. To trigger the XSS vulnerability, the victim must visit the page` /edit?configuration=[xss file]`. Abusing this vulnerability a malicious actor could perform operations on the dashboard on the behalf of a logged user, access sensitive information, create, edit and delete configuration files and flash firmware on managed boards.\nIn addition to this, cookies are not correctly secured, allowing the exfiltration of session cookie values. Version 2024.2.2 contains a patch for this issue.","ecosystems":["PyPI"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"ESPHome vulnerable to stored Cross-site Scripting in edit configuration file API","id":"CVE-2024-27287","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"xss","year":"2024"},"n_packages":3,"n_references":2,"next":{"headline":"1Panel open source panel project has an unauthorized vulnerability.","id":"CVE-2024-27288"},"packages":[{"ecosystem":"PyPI","fixed":["2024.2.2"],"introduced":["2023.12.9"],"last_affected":[],"package":"esphome","purl":null,"source":"GHSA-9p43-hj5j-96h5"},{"ecosystem":"PyPI","fixed":["2024.2.2"],"introduced":["2023.12.9"],"last_affected":[],"package":"esphome","purl":"pkg:pypi/esphome","source":"GHSA-9p43-hj5j-96h5"},{"ecosystem":"PyPI","fixed":["2024.2.2"],"introduced":["2023.12.9"],"last_affected":[],"package":"esphome","purl":"pkg:pypi/esphome","source":"PYSEC-2026-1329"}],"prev":{"headline":"Moving single messages from public to private streams leaves them accessible","id":"CVE-2024-27286"},"products":["esphome"],"published":"2024-03-06","related":[{"cvss_score":7.2,"headline":"ESPHome remote code execution via arbitrary file write","id":"CVE-2024-27081","kev_date_added":null,"published":"2024-02-26"},{"cvss_score":1.7,"headline":"ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component","id":"CVE-2026-23833","kev_date_added":null,"published":"2026-01-19"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2024-08-26","vendors":["esphome"]},"summary":"Authenticated attackers can inject scripts into ESPHome dashboard configuration files to steal session cookies and perform actions on behalf of victims.","url":"https://insights.sbomify.com/CVE-2024-27287/"}