CVE-2024-42469 CometVisu Backend for openHAB affected by RCE through path traversal

What is CVE-2024-42469?

CVE-2024-42469 is a critical path traversal vulnerability in openhab-webui, published on 9 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Prior to version 4.2.1, CometVisu's file system endpoints don't require authentication and additionally the endpoint to update an existing file is susceptible to path traversal. This makes it possible for an attacker to overwrite existing files on the openHAB instance. If the overwritten file is a shell script that is executed at a later time, this vulnerability can allow remote code execution by an attacker. Users should upgrade to version 4.2.1 to receive a patch.

Weakness: CWE-22

Which versions are affected by CVE-2024-42469?

2 open source packages ship an affected version, including org.openhab.ui.bundles:org.openhab.ui.cometvisu. It affects 1 product.

Products include Openhab Openhab.

How do I fix CVE-2024-42469?

Upgrade org.openhab.ui.bundles:org.openhab.ui.cometvisu to 4.2.1 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-42469 being exploited?

There is no known exploitation of CVE-2024-42469 in the wild and no public exploit code.

Other vulnerabilities in openhab-webui

• CVE-2020-5242 openHAB exec add-ons allow remote arbitrary command execution High 7.7
• CVE-2024-42470 CometVisu Backend for openHAB has a sensitive information disclosure vulnerability Medium 6.5
• CVE-2021-21266 XXE vulnerability in OpenHAB Medium 6.4
• CVE-2024-42468 Path traversal (CometVisu) Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f729-58x4-gqgf.