From d2dfbb264d3197bed60b4c0bfdb0d2832efdfd0e Mon Sep 17 00:00:00 2001 From: Chris Date: Fri, 19 Jun 2026 01:22:36 +0200 Subject: [PATCH] Fix HomeMatic Script injection in hmscript_escapeString MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit hmscript_escapeString escaped quotes but never escaped the backslash character itself. A user-supplied string value containing a backslash positioned before a quote would, once the quote was escaped to \", be decoded by ReGa as an escaped backslash that closes the generated `var name = "...";` literal early — turning the remainder of the input into executable HomeMatic Script. Because the API funnels user input through this helper, an authenticated low-privilege (LEVEL USER) caller could reach system.Exec and run OS commands as root. Escape backslash first so backslashes introduced by escaping are themselves escaped. This also fixes silent loss of literal backslashes in benign values (e.g. Windows-style paths). --- WebUI/www/api/eq3/hmscript.tcl | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/WebUI/www/api/eq3/hmscript.tcl b/WebUI/www/api/eq3/hmscript.tcl index 6d45346bc..347b3e911 100755 --- a/WebUI/www/api/eq3/hmscript.tcl +++ b/WebUI/www/api/eq3/hmscript.tcl @@ -58,7 +58,12 @@ proc hmscript_runFromFile { filename {p_args -}} { } proc hmscript_escapeString { str } { + # Backslash MUST be escaped first, otherwise a backslash placed directly + # before a quote in user input would (after the quote is escaped to \") + # be read by ReGa as an escaped backslash, closing the string literal + # early and turning the rest of the input into executable HomeMatic Script. return [string map { + "\\" "\\\\" "\'" "\\\'" "\"" "\\\"" "\n" "\\n"