CVE-2024-27287: ESPHome Dashboard XSS Vulnerability

CVE-2024-27287 Overview

ESPHome is a system for controlling ESP8266/ESP32 microcontrollers used in home automation deployments. CVE-2024-27287 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the ESPHome dashboard component. The flaw affects versions from 2023.12.9 up to (but not including) 2024.2.2, including both the command-line installation and the Home Assistant add-on. An authenticated attacker can inject arbitrary JavaScript into configuration files through the /edit endpoint. When a victim visits /edit?configuration=[malicious file], the payload executes in their browser session. Session cookies are also not properly secured, enabling their exfiltration.

Critical Impact
A malicious authenticated user can execute JavaScript in another user's dashboard session, exfiltrate session cookies, modify configuration files, and flash firmware on managed ESP boards.

Affected Products

ESPHome 2023.12.9 through versions prior to 2024.2.2 (command-line installation)
ESPHome Home Assistant add-on in the same version range
ESPHome dashboard component (esphome/dashboard/web_server.py)

Discovery Timeline

2024-03-06 - CVE-2024-27287 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-27287

Vulnerability Analysis

The ESPHome dashboard exposes an /edit endpoint that reads and writes YAML configuration files. When the server responds to a GET request for a configuration file, it returns the file contents with the HTTP header Content-Type: text/html; charset=UTF-8. Because the response is served as HTML and the file contents are not sanitized, any HTML or JavaScript embedded in a configuration file is interpreted by the browser.

An authenticated user can issue a POST request to /edit and control the target filename through the configuration parameter. This writes attacker-controlled content to disk. When another dashboard user later opens /edit?configuration=[attacker-file], the browser renders the injected script under the dashboard origin.

Root Cause

The root cause is incorrect Content-Type handling in the dashboard's file-serving code path. Configuration files, which are YAML documents, were served as text/html. Combined with the absence of output encoding and insufficient cookie hardening (missing HttpOnly/Secure-style protections that would prevent script access to session cookies), the flaw allows stored XSS with cookie theft.

Attack Vector

Attack requires network access to the dashboard and low-privilege authenticated access. Exploitation requires user interaction: the victim must visit a crafted URL. Because the dashboard governs firmware flashing, a successful attack extends beyond the browser: the attacker can invoke dashboard operations as the victim, including creating, editing, and deleting configuration files and pushing firmware to managed ESP8266/ESP32 boards.

python

            None, self._read_file, filename, configuration
         )
         if content is not None:
+            self.set_header("Content-Type", "application/yaml")
             self.write(content)
 
     def _read_file(self, filename: str, configuration: str) -> bytes | None:

Source: ESPHome patch commit 37d2b3c. The fix sets the response Content-Type to application/yaml, so browsers no longer interpret configuration file contents as HTML.

Detection Methods for CVE-2024-27287

Indicators of Compromise

POST requests to /edit where the configuration parameter references unusual filenames or filenames containing HTML/JavaScript tokens such as <script, onerror=, or javascript:.
GET requests to /edit?configuration= targeting non-standard YAML files, particularly from browsers with active dashboard sessions.
Configuration files on disk containing <script>, event-handler attributes, or other HTML markup inconsistent with normal ESPHome YAML syntax.
Unexpected firmware flash operations or configuration changes performed under a legitimate user's identity.

Detection Strategies

Scan the ESPHome configuration directory for files whose contents contain HTML tags or JavaScript keywords that should not appear in valid YAML.
Inspect HTTP access logs for the dashboard for POST/GET requests to /edit and correlate the configuration parameter value across users.
Verify the version string reported by ESPHome is 2024.2.2 or later; earlier versions in the affected range are vulnerable.

Monitoring Recommendations

Log and alert on all authenticated write operations to the /edit endpoint, including the filename parameter.
Monitor for anomalous outbound requests from browsers accessing the ESPHome dashboard, which can indicate cookie exfiltration.
Track firmware flash events and configuration file modifications, and reconcile them against authorized change activity.

How to Mitigate CVE-2024-27287

Immediate Actions Required

Upgrade ESPHome to version 2024.2.2 or later on both command-line installations and the Home Assistant add-on.
Rotate any dashboard user credentials and invalidate active sessions after upgrade, given the cookie exfiltration risk.
Audit configuration files in the ESPHome working directory for injected HTML or JavaScript content and remove offending files.

Patch Information

The fix is included in ESPHome 2024.2.2. The patch, tracked in GHSA-9p43-hj5j-96h5 and implemented in commit 37d2b3c, sets the response Content-Type header to application/yaml when serving configuration files. Browsers no longer render the contents as HTML, which neutralizes the stored XSS.

Workarounds

Restrict network access to the ESPHome dashboard to trusted management hosts using a firewall or reverse-proxy allow-list.
Limit dashboard accounts to trusted operators and remove unused users until patching is complete.
Place the dashboard behind a reverse proxy that enforces a strict Content-Security-Policy header to constrain inline script execution.

bash

# Upgrade ESPHome to a patched release
pip install --upgrade 'esphome>=2024.2.2'

# Verify installed version
esphome version