Security readout for executives and security teams
Plain-English summary
An unauthenticated CometVisu proxy can make openHAB contact internal systems and can return attacker-controlled JavaScript under openHAB’s trusted browser origin. This may expose data or permit unauthorized actions. Remote code execution is described only as a possible outcome when combined with other vulnerabilities.
Executive priority
Remediate immediately where openHAB is reachable from the internet or untrusted networks; treat private deployments as urgent because crafted links can target administrators. Confirm ownership, upgrade completion, and exposure reduction. Investigate suspicious proxy activity, while avoiding claims of compromise without supporting evidence.
Technical view
CometVisu versions 3.4.0.M4 through 4.2.0 expose a proxy endpoint without authentication. Attackers can induce server-side GET requests to otherwise internal resources. They can also proxy malicious content that executes as the CometVisu UI origin, enabling same-origin requests against openHAB. The supplied CVSS 3.1 score is 10.0.
Likely exposure
Affected deployments run the openHAB CometVisu add-on from 3.4.0.M4 through 4.2.0. Internet or other untrusted-network exposure enables direct unauthenticated SSRF. Private deployments may still face browser-based XSS risk if an administrator follows a crafted link.
Exploitation context
The source bundle does not identify this CVE as CISA KEV-listed and provides no evidence of active exploitation. Exploitation requires access to the proxy endpoint for SSRF, or convincing a user to open attacker-supplied content for the described private-network XSS scenario. RCE requires chaining with other vulnerabilities.
Researcher notes
The vulnerability combines unauthenticated SSRF with same-origin script execution through attacker-controlled proxied responses. Scope changes in the supplied CVSS vector, while availability impact is rated none. The bundle maps CWE-918 but does not provide a separate XSS CWE. Patch review should focus on authentication, destination controls, and response handling.
Mitigation direction
- Upgrade the CometVisu add-on to version 4.2.1 or later.
- Until upgraded, prevent untrusted access to the CometVisu proxy and limit openHAB network exposure.
- Restrict unnecessary outbound access from the openHAB host to internal services.
- Review the vendor advisory and subsequent openHAB guidance for deployment-specific protections.
Validation and detection
- Inventory openHAB installations and identify the installed CometVisu add-on version.
- Confirm affected systems have upgraded to CometVisu 4.2.1 or later.
- Verify the proxy endpoint is no longer anonymously usable after remediation.
- Review access logs for unexpected proxy requests from untrusted sources.
- Review network telemetry for unusual outbound GET requests originating from openHAB.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-918: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCloud metadata behavior lookup
The CVE wording references SSRF or metadata access, so cloud discovery and credential material review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2024-42467 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 10 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N3.95.8GitHub_MVulnerability scoring details
Base CVSS 3.1 score
10CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/openhab/openhab-webui/security/advisories/GHSA-v7gr-mqpj-wwh3CVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/openhab/openhab-webui/commit/531dabfa8311a50d2e740bf4f2b4f2400e78646c#diff-b9a920cefe5f9b2ee3615cb29f88bcad0535012c2ae2535bd12e47d6d9395b6aCVE reference, GitHub_M · x_refsource_MISC
- https://github.com/openhab/openhab-webui/commit/630e8525835c698cf58856aa43782d92b18087f2CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/openhab/openhab-webui/blob/1c03c60f84388b9d7da0231df2d4ebb1e17d3fcf/bundles/org.openhab.ui.cometvisu/src/main/java/org/openhab/ui/cometvisu/internal/backend/rest/ProxyResource.java#L83CVE reference, GitHub_M · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Server-Side Request Forgery (SSRF)
Server-Side Request Forgery (SSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.