While working on improving the Emoncms API user interface helper pages, I discovered (or rather claude did) a very simple and serious privileged escalation vulnerability in the schedule, process and device module API helper pages that has unfortunately been present for 12 years - patched today in version 11.16.8 of Emoncms core and version 2.5.0 of the Emoncms device module. Emoncms.org has also been updated.
The vulnerability made it possible to use a read apikey to find the write apikey of a user account. A write apikey could then be used to modify and delete feed data. With a write apikey it was also then possible to access and change the account email address which could be used for full account takeover (this second stage escalation has also been mitigated in this update).
To exploit this an attacker would need a copy of an accounts read key and public access to the web server running any version of emoncms and the device module prior to the latest releases (<11.16.8 of core and <2.5.0 of the device module).
An attacker could get access to an accounts read key if it’s shared publicly e.g on the forums here as a dashboard/app share link.
Correct and most folk sharing read key’s would have been on emoncms.org which is now patched.
There was a SQL injection vulnerability in the dashboard module fixed back in May. That update also included a number of defense in depth improvements Emoncms v11.12.3 stable release - security fixes
I’m using an original emonPi with 868 MHz radios so I have to be very careful what I update - ie, not the “emon” processor that does the energy measurement, because that also receives the radio transmissions.
