CVE-2013-4864

Vulnerability

The MiCasaVerde VeraLite home automation controller running firmware version 1.5.408 contains a Server-Side Request Forgery (SSRF) vulnerability in the cgi-bin/cmh/proxy.sh script. The script accepts a url parameter without proper validation, allowing an attacker to force the device to send arbitrary HTTP requests to internal or external servers. This issue is documented in multiple advisories [1][2][3].

Exploitation

An attacker can exploit this vulnerability by sending a crafted HTTP request to the VeraLite's web interface, specifying a target URL in the url parameter. No authentication is required if the attacker has network access to the device. For example, a request to http:///cgi-bin/cmh/proxy.sh?url=http://internal-server/ would cause the VeraLite to make a request to the internal server. The attacker can also use this to scan internal networks or interact with services that are not directly accessible from the internet.

Impact

Successful exploitation allows an attacker to perform SSRF attacks, enabling them to send HTTP requests to intranet servers that are otherwise unreachable. This can lead to information disclosure, internal network reconnaissance, and potential further exploitation of internal services. The attacker can leverage the VeraLite as a proxy to attack other systems within the local network.

Mitigation

As of the available references, no official patch has been released for this vulnerability. The affected firmware version is 1.5.408. Users should consider upgrading to a newer firmware version if available, or restrict network access to the VeraLite's web interface to trusted hosts only. The device may also be placed behind a firewall to limit exposure. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.