Smartwares Home Easy Authentication Bypass Vulnerability Allowing Access to Administrative Web Pages

A client-side authentication bypass vulnerability has been identified in Smartwares HOME easy version 1.0.9. This vulnerability allows unauthenticated attackers to access administrative web pages by disabling JavaScript, thereby bypassing client-side validation and redirection. Exploitation of this vulnerability can lead to unauthorized access to sensitive system information, including the disclosure of an SQLite3 database file and its location.

Impact

Exploitation of this vulnerability bypasses authentication mechanisms, allowing unauthorized access to administrative functionalities and sensitive system information.

Reproduction

To reproduce this vulnerability, disable JavaScript in the web browser. Then, navigate to the administrative endpoints of the Smartwares HOME easy application. The authentication bypass will allow access to various administrative pages, such as task management, room settings, and system information.