Brief Summary: CVE-2021-47942 Path Traversal in HACS Leads to Home Assistant Account Takeover

Introduction

An unauthenticated path traversal flaw in the Home Assistant Community Store (HACS) lets any network-adjacent attacker read the credential storage file from a Home Assistant instance and forge a valid administrative session, all without ever logging in. A public exploit script is available on Exploit DB, and there is evidence of vulnerable instances exposed on the internet, so this is a practical threat to the large HACS user base.

HACS is a custom integration for Home Assistant that adds a graphical interface for discovering, installing, and managing community-created components. The project has approximately 7,300 stars and 1,500 forks on GitHub, which points to wide adoption within the Home Assistant ecosystem. Home Assistant is one of the most popular open-source home automation platforms, so a vulnerability in an integration as widely used as HACS has a large potential blast radius.

Technical Information

Root Cause: Unsanitized File Parameter in /hacsfiles/

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The /hacsfiles/ endpoint in HACS accepted a file parameter and passed it directly, without any sanitization, to the function that locates the file on the filesystem. The endpoint was meant to serve files from the /www/community/ directory. Because the input was never validated, an attacker could insert directory traversal sequences (e.g., ../../) to escape that directory and read any file the Home Assistant process could access.

The fix in HACS version 1.10.0 applies a sanitize path function to the requested file parameter before it is used for filesystem lookups. Home Assistant Core version 2021.1.3 added a second, platform-level defense that intercepts directory traversal attempts before they reach any custom integration code.

Attack Flow

The exploitation chain requires no authentication at any stage:

1. The attacker confirms that HACS is installed on the target by requesting a known file, such as iconset.js, through the /hacsfiles/ endpoint. A successful response means the integration is present.
2. The attacker sends a request with directory traversal sequences to read the .storage/auth file. Home Assistant uses this file to persist user sessions, so users do not need a password for every interaction.
3. The .storage/auth file contains two critical sections, users and refresh_tokens. The attacker extracts a valid refresh_token value and its associated jwt_key.
4. With the extracted jwt_key, the attacker generates a new JSON Web Token signed with the HS256 algorithm. This token is cryptographically valid and indistinguishable from one generated by a legitimate session.
5. The attacker places the crafted token in their browser's local storage under the key hassTokens.
6. When the attacker opens the Home Assistant instance, the application accepts the forged token and grants them full administrative privileges.

The whole chain, from fingerprinting to administrative access, needs nothing more than network reachability to the Home Assistant instance.

Affected Systems and Versions

All versions of the Home Assistant Community Store (HACS) prior to version 1.10.0 are affected.

The same class of directory traversal vulnerability was also found in several other Home Assistant custom integrations:

• Dwains Lovelace Dashboard (fixed in 2.0.1)
• Font Awesome (fixed in 1.3.0)
• BWAlarm ak74 edition (fixed in 1.12.8)
• Simple Icons (fixed in 1.10.0)
• Custom Updater, deprecated (fixed in latest commit)
• Custom icons (no fix available; should be removed)

Home Assistant Core versions prior to 2021.1.3 lack the platform-level directory traversal protections that mitigate this class of vulnerability across all custom integrations.

Vendor Security History

The Home Assistant project handled this disclosure with a well-coordinated response. After receiving the report on January 14, 2021, the team worked with the authors of the affected custom integrations to develop fixes before public disclosure. It published a security bulletin, displayed banners and forum notifications, updated the Companion apps to warn users of insecure instances, and worked with Nabu Casa to email subscribers and turn on features that block remote access for insecure versions. The platform-level fix in Core 2021.1.3 went further than patching the individual vulnerability. It adds systemic protections against directory traversal in all custom integrations, which addresses the root cause.

References

• NVD Entry for CVE-2021-47942
• VulnCheck Advisory: Home Assistant Community Store Path Traversal Account Takeover
• Exploit DB: Home Assistant Community Store (HACS) 1.10.0 Directory Traversal (ID 49495)
• Home Assistant Security Disclosure Blog Post
• HACS Integration GitHub Repository
• HACS Fix Commit: Change File Handling (f2b7cb7)
• Home Assistant Official Website