Skip to content
OpenAdvisories
High · 8.6 Public exploit CVE-2023-41898 EUVD-2023-46377

Arbitrary URL load in Android WebView in `MyActivity.kt` in Home Assistant Companion for Android

Published Oct 19, 2023 · Updated Sep 12, 2024 · Assigned by GitHub_M

Vendor: home-assistant Product: core

Description

Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in a WebView. This enables all sorts of attacks, including arbitrary JavaScript execution, limited native code execution, and credential theft. This issue has been patched in version 2023.9.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GitHub Security Lab (GHSL) Vulnerability Report: `GHSL-2023-142`.

Affected products

VendorProductAffectedFixed
home-assistant core < 2023.9.2 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References