Hacker News Reader

> The issue allowed an attacker to remotely bypass authentication and interact directly with the Supervisor API. This gives an attacker access to install Home Assistant updates and manage add-ons and backups. Our analysis shows that this issue has been in Home Assistant since the introduction of the Supervisor in 2017.

Holy shit.

View on HN

This would primarily be a concern if someone decided to expose the machine running HA to the Internet.

This is one of the reasons I’ve never used port forwarding for external access to anything run locally.

The vulnerability is still bad, but at least only accessible to my home network.

Shodan lists 125,000 HA installs exposed to the internet (though I don't know how accurate that statistic is, nor what fraction have a Supervisor) https://www.shodan.io/search?query=product%3A"Home+Assistant...

Wouldn’t it have to be an exposed supervisor port to the internet? It’s not enough to just be running supervisor and having home assistant exposed, right?

I don't believe so – from a quick glance it seems that supervisor requests are proxied through the normal HA port, and the supervisor doesn't have it's own port except for the Observer (which seems to be a simple read-only thing).

Reply on news.ycombinator.com