VYPR
← All advisories
Moderate severityNVD Advisory· Published Mar 6, 2024· Updated Aug 26, 2024

ESPHome vulnerable to stored Cross-site Scripting in edit configuration file API

CVE-2024-27287

Description

ESPHome is a system to control your ESP8266/ESP32 for Home Automation systems. Starting in version 2023.12.9 and prior to version 2024.2.2, editing the configuration file API in dashboard component of ESPHome version 2023.12.9 (command line installation and Home Assistant add-on) serves unsanitized data with Content-Type: text/html; charset=UTF-8, allowing a remote authenticated user to inject arbitrary web script and exfiltrate session cookies via Cross-Site scripting. It is possible for a malicious authenticated user to inject arbitrary Javascript in configuration files using a POST request to the /edit endpoint, the configuration parameter allows to specify the file to write. To trigger the XSS vulnerability, the victim must visit the page /edit?configuration=[xss file]. Abusing this vulnerability a malicious actor could perform operations on the dashboard on the behalf of a logged user, access sensitive information, create, edit and delete configuration files and flash firmware on managed boards. In addition to this, cookies are not correctly secured, allowing the exfiltration of session cookie values. Version 2024.2.2 contains a patch for this issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
esphomePyPI
>= 2023.12.9, < 2024.2.22024.2.2

Affected products

1

Patches

1
37d2b3c7977a

Merge pull request from GHSA-9p43-hj5j-96h5

https://github.com/esphome/esphomeJesse HillsMar 5, 2024via ghsa
commit
1 file changed · +1 −0
  • esphome/dashboard/web_server.py+1 −0 modified
    @@ -820,6 +820,7 @@ async def get(self, configuration: str | None = None) -> None:
             None, self._read_file, filename, configuration
         )
         if content is not None:
+            self.set_header("Content-Type", "application/yaml")
             self.write(content)
 
     def _read_file(self, filename: str, configuration: str) -> bytes | None:

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

3

News mentions

0

No linked articles in our index yet.