CometVisu 后端 (Backend) for openHAB 受路径遍历 (path traversal) 漏洞影响，可能导致远程代码执行 (RCE)

The primary impact of CVE-2024-42469 is the potential for remote code execution. An attacker can exploit this vulnerability by overwriting files within the openHAB instance, particularly shell scripts that are subsequently executed. Successful exploitation could grant the attacker full control over the affected system, enabling them to steal sensitive data, install malware, or disrupt services. The lack of authentication for file system endpoints significantly increases the attack surface, making it easier for unauthorized individuals to exploit this vulnerability. The path traversal vulnerability allows attackers to write files outside of the intended directory, further amplifying the potential for damage.

Organizations running openHAB instances, particularly those with external network access or exposed web interfaces, are at risk. Shared hosting environments where multiple users share the same openHAB instance are especially vulnerable, as an attacker could potentially compromise the entire hosting environment through a single openHAB instance. Legacy openHAB configurations with outdated security practices are also at increased risk.

• linux / server: Monitor openHAB logs for unusual file access patterns, particularly attempts to access or modify files outside of expected directories. Use journalctl -u openhab to filter for relevant events.

journalctl -u openhab | grep -i 'path traversal'

• generic web: Use curl to test file endpoints with crafted paths containing directory traversal sequences (e.g., ../).

curl http://<openhab_ip>/cometvisu/files/../../../../etc/passwd

• java: Examine openHAB application logs for errors related to file access or path validation. Use Java profiling tools to monitor file I/O operations within the CometVisu component.

1. 2024-08-09Disclosure

   disclosure

1. 已保留2024-08-02
2. 发布日期2024-08-09
3. 修改日期2024-08-12
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2024-42469 is to immediately upgrade to openHAB version 4.2.1 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict network access to the openHAB instance to only trusted sources. Implement strict file system permissions to limit the attacker's ability to overwrite critical files. Monitor file system activity for suspicious modifications. While a WAF or proxy cannot directly prevent this vulnerability, it can help detect and block malicious requests attempting to exploit it. After upgrading, confirm the fix by attempting to access the vulnerable file endpoints with invalid paths to ensure access is denied.