CVE-2024-42467: SSRF in openHAB CometVisu

The SSRF vulnerability in openHAB CometVisu presents a significant security risk. An attacker can exploit this flaw to bypass internal network security controls and access resources that are not publicly accessible. This could include sensitive configuration files, internal APIs, or even databases. By crafting malicious HTTP requests through the proxy endpoint, an attacker can induce openHAB to interact with internal services, potentially leading to data exfiltration or further compromise. The lack of authentication for the proxy endpoint amplifies the risk, as any user can trigger these requests. This vulnerability shares similarities with other SSRF exploits where internal services are inadvertently exposed due to misconfigured proxy functionality.

1. Reserved2024-08-02
2. Published2024-08-09
3. Modified2024-08-12
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-42467 is to upgrade openHAB to version 4.2.1 or later, which includes the necessary fix. If an immediate upgrade is not feasible, consider implementing temporary workarounds. Restrict network access to the openHAB instance to only trusted sources. Implement a Web Application Firewall (WAF) with rules to block suspicious outbound requests originating from the CometVisu proxy endpoint. Carefully review and restrict the allowed domains or IP addresses that the proxy can access. Monitor openHAB logs for unusual outbound HTTP requests that could indicate exploitation attempts. After upgrading, confirm the fix by attempting to access an internal resource through the CometVisu proxy endpoint; the request should be denied.