homebridge-unfinished-install: Homebridge - Unfinished Installation

id: homebridge-unfinished-install

info:
  name: Homebridge - Unfinished Installation
  author: theamanrawat
  severity: high
  description: |
    Homebridge instance with incomplete installation detected. The setup wizard is exposed, allowing anyone to create the first admin account and gain full control over the Homebridge instance. This can lead to unauthorized access to smart home devices and potential network compromise.
  reference:
    - https://homebridge.io/
    - https://github.com/homebridge/homebridge-config-ui-x
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-284
  metadata:
    verified: true
    max-request: 2
    shodan-query: title:"Homebridge"
    fofa-query: title="Homebridge"
  tags: homebridge,misconfig,exposure,iot,smart-home,unauth,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "<title>Homebridge")'
        condition: and
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/api/auth/settings"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"setupWizardComplete":false'

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200
# digest: 490a004630440220332b94058e387c6dcf36ac298329e26c28db04d7475d651c2ef94f4f9677f31a02204c1a4367420b4050fc5a19e6169762dc94e12319144aadf8db3b688fb260a81a:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.