Executive brief
domokeeper is a Node.js package that provides home automation or system management functionality. A vulnerability in the /plugin/ route allows unauthenticated attackers to include and execute arbitrary files or read sensitive configuration files (such as .json) from the server, potentially leading to code execution or information disclosure.
Technical details
The vulnerability is a Local File Inclusion (LFI) flaw in the /plugin/ route handler. The route accepts a GET parameter that is passed unsanitized directly to a require() call, allowing an attacker to load arbitrary JavaScript files from the application's file system. Because the output of require() is returned in the server response, attackers can both execute unintended code within the application context and exfiltrate sensitive data from JSON configuration files. No authentication is required to exploit this vulnerability. No patch has been made available as of the advisory publication date.
Affected products
- domokeeper domokeeper all versions
Timeline
- 2020-09-03: disclosed