CVE-2024-42467

openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. In versions 3.4.0.M4 through 4.2.0,, the proxy endpoint of openHAB's CometVisu add-on can be accessed without authentication. This proxy-feature can be exploited as Server-Side Request Forgery (SSRF) to induce GET HTTP requests to internal-only servers, in case openHAB is exposed in a non-private network. Furthermore, this proxy-feature can also be exploited as a Cross-Site Scripting (XSS) vulnerability, as an attacker is able to re-route a request to their server and return a page with malicious JavaScript code. Since the browser receives this data directly from the openHAB CometVisu UI, this JavaScript code will be executed with the origin of the CometVisu UI. This allows an attacker to exploit call endpoints on an openHAB server even if the openHAB server is located in a private network. (e.g. by sending an openHAB admin a link that proxies malicious JavaScript.) This issue may lead up to Remote Code Execution (RCE) when chained with other vulnerabilities. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to receive a patch.

• CWE-918

• https://github.com/openhab/openhab-webui/blob/1c03c60f84388b9d7da0231df2d4ebb1e17d3fcf/bundles/org.openhab.ui.cometvisu/src/main/java/org/openhab/ui/cometvisu/internal/backend/rest/ProxyResource.java#L83Product
• https://github.com/openhab/openhab-webui/commit/531dabfa8311a50d2e740bf4f2b4f2400e78646c#diff-b9a920cefe5f9b2ee3615cb29f88bcad0535012c2ae2535bd12e47d6d9395b6a
• https://github.com/openhab/openhab-webui/commit/630e8525835c698cf58856aa43782d92b18087f2Patch
• https://github.com/openhab/openhab-webui/security/advisories/GHSA-v7gr-mqpj-wwh3Third Party Advisory

Published

Aug 12, 2024

Last Modified

Aug 5, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-42461In the Elliptic package 6.5.6 for Node.js, ECDSA signature m…9.1
• CVE-2024-42462Improper Authentication vulnerability in upKeeper Solutions …9.8
• CVE-2024-42463Authorization Bypass Through User-Controlled Key vulnerabili…6.5
• CVE-2024-42464Authorization Bypass Through User-Controlled Key vulnerabili…6.5
• CVE-2024-42465Improper Restriction of Excessive Authentication Attempts vu…9.8
• CVE-2024-42466Improper Restriction of Excessive Authentication Attempts vu…9.8
• CVE-2024-42468openHAB, a provider of open-source home automation software,…7.5
• CVE-2024-42469openHAB, a provider of open-source home automation software,…9.8
• CVE-2024-4247A vulnerability has been found in Tenda i21 1.0.0.14(4656) a…8.8
• CVE-2024-42470openHAB, a provider of open-source home automation software,…9.1
• CVE-2024-42471actions/artifact is the GitHub ToolKit for developing GitHub…7.5
• CVE-2024-42472Flatpak is a Linux application sandboxing and distribution f…10