Executive brief
ioBroker is an open-source home automation platform that runs adapters (plugins) to control smart home devices. A path traversal vulnerability in its core controller component allows attackers to write arbitrary files outside the intended adapter directory, potentially compromising the integrity and security of the entire system. Authentication is disabled by default, making this vulnerability easily exploitable on default installations.
Technical details
This is a path traversal vulnerability (CWE-22) in iobroker.js-controller versions prior to 2.0.25, where the package fails to properly validate and restrict file operations to the intended /adapter/<adapter-name> directory. An attacker can craft requests containing path traversal sequences (e.g., "../") to write files to arbitrary locations on the filesystem. While the vulnerability nominally requires authentication, the package ships with authentication disabled by default, making exploitation trivial over the network. A successful exploit allows an attacker to overwrite critical system files or inject malicious code into the application, leading to full system compromise. The fix was applied in version 2.0.25 via security enhancements to path validation.
Affected products
- ioBroker js-controller prior to 2.0.25
Timeline
- 2019-12-02: disclosed
- 2019-11-27: patched: fix committed to repository