CometVisu Backend for openHAB affected by SSRF/XSS

The SSRF vulnerability in openHAB CometVisu poses a significant risk because it bypasses authentication controls for the proxy endpoint. An attacker can craft malicious requests through this endpoint, instructing the openHAB server to make GET requests to internal resources that are not directly accessible from the outside world. This could expose sensitive data residing on internal servers, such as configuration files, database credentials, or even internal web applications. The potential for lateral movement is high, as an attacker could use the SSRF to scan the internal network and identify other vulnerable services. The blast radius extends to any internal resource accessible via HTTP GET, potentially compromising the entire internal network if openHAB is exposed in a non-private environment.

Organizations deploying openHAB in non-private networks, particularly those with sensitive internal services, are at significant risk. Environments with legacy openHAB configurations or those relying on shared hosting services are also particularly vulnerable, as they may have limited control over network access and security settings.

• linux / server:

journalctl -u openhab -g "cometvisu proxy endpoint"

• generic web:

curl -I http://<openhab_ip>/cometvisu/proxy?url=<internal_resource>

Check the response headers for unexpected redirects or server responses indicating access to internal resources. • generic web: Grep access logs for requests to the /cometvisu/proxy endpoint with unusual or internal URLs.

1. 2024-08-09Disclosure

   disclosure

1. Reserviert2024-08-02
2. Veröffentlicht2024-08-09
3. Geändert2024-08-12
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-42467 is to upgrade openHAB to version 4.2.1 or later, which includes a fix for the SSRF vulnerability. If upgrading immediately is not feasible, consider restricting network access to the openHAB server to prevent external access to the proxy endpoint. Implement a Web Application Firewall (WAF) with rules to block suspicious HTTP GET requests originating from the CometVisu proxy. Monitor openHAB logs for unusual outbound HTTP requests that could indicate exploitation attempts. After upgrading, confirm the fix by attempting to access the proxy endpoint with a known malicious URL and verifying that the request is blocked or denied.