CVE-2021-47942

EUVD-2021-34838
Home Assistant Community Store (HACS) prior to 1.10.0 contains a path traversal vulnerability that allows unauthenticated attackers to read sensitive files by traversing directories via the /hacsfiles/ endpoint. Attackers can retrieve the .storage/auth file containing user credentials and refresh tokens, then craft valid JWT tokens to gain administrative access to Home Assistant instances.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 38%
Affected Products (NVD)
VendorProductVersion
hacshome_assistant_community_store
𝑥
< 1.10.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/hacs/integration
https://www.exploit-db.com/exploits/49495
https://www.home-assistant.io/
https://www.vulncheck.com/advisories/home-assistant-community-store-path-traversal-account-takeover