Home Assistant Blueprint Studio Bypass & Credential Leak Fix

Vulnerability Overview This vulnerability involves insufficient access control on the Blueprint Studio backend API, allowing non-administrator users to potentially execute sensitive operations. Specifically: 1. Insufficient API Access Control: Non-administrator users may access and execute sensitive operations such as template rendering, global search/replace, file access, Git operations, SFTP operations, and file uploads. 2. Improper Handling of Git Credentials: The Git credential helper no longer embeds raw credentials into generated shell scripts or plain-text credential stores for Git configuration. Instead, it uses in-memory parameter sessions to avoid writing private keys to disk. 3. Binding of Terminal Command Working Directory: The working directory for terminal commands is bound to the Home Assistant configuration directory. The API returns generic error messages in case of exceptions, while retaining detailed information in logs. Impact Scope Affected Versions: v2.5.1 and earlier. Impacted Features: - Template rendering - Global search/replace - File access - Git operations - SFTP operations - Upload operations - Terminal command execution Remediation 1. API Access Control: - Restrict the Blueprint Studio backend API (API, stream, upload) to align with administrator-only UI permissions, and log unauthorized attempts. - Replace detailed API error payloads with generic error messages, while retaining full trace information for logging purposes. 2. Git Credential Handling: - Improve Git credential handling by validating credential values to prevent embedding raw credentials into generated shell scripts or plain-text credential stores for Git configuration. - Use in-memory parameter sessions to avoid writing private keys to disk. 3. Binding of Terminal Command Working Directory: - Bind the working directory of terminal commands to the Home Assistant configuration directory. - The API returns generic error messages in case of exceptions, while retaining detailed information in logs. POC Code The following code snippets are related to the vulnerability: The above code demonstrates the specific implementation of the vulnerability and the remediation measures.

Goal Reached Thanks to every supporter — we hit 100%!

Home Assistant Blueprint Studio Bypass & Credential Leak Fix

More from this source