漏洞描述
Home Assistant Supervisor is an open source home automation tool. A remotely exploitable vulnerability bypassing authentication for accessing the Supervisor API through Home Assistant has been discovered.This impacts all Home Assistant installation types that use the Supervisor 2023.01.1 or older. Installation types, like Home Assistant Container (for example Docker), or Home Assistant Core manually in a Python environment, are not affected.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
www.elttam.comhttps://www.elttam.com/blog/pwnassistant/↗github.comhttps://github.com/elttam/publications/blob/master/writeups/home-assistant/supervisor-authentication-bypass-advisory.md↗www.home-assistant.iohttps://www.home-assistant.io/blog/2023/03/08/supervisor-security-disclosure/↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2023-27482↗github.comhttps://github.com/home-assistant/core/security/advisories/GHSA-2j8f-h4mr-qr25↗xz.aliyun.comhttps://xz.aliyun.com/t/12572↗