An unauthenticated remote file inclusion vulnerability in FIBARO Home Center smart home hubs allows attackers to execute malicious scripts, posing a significant risk of session hijacking and site manipulation.

The vulnerability exists within an undocumented proxy API, which fails to properly validate the url GET parameter. This allows an unauthenticated attacker to include and execute arbitrary client-side scripts, such as JavaScript, within the context of the user session.

Successful exploitation of this flaw can lead to unauthorized session hijacking, potentially granting an attacker full control over the smart home environment. Furthermore, an attacker can modify the appearance of the web interface to facilitate phishing or deceive users. Given the CVSS score of 7.5, this high-severity vulnerability represents a significant risk to the integrity and confidentiality of the home automation system.

Immediate Action: Upgrade all FIBARO Home Center units to a firmware version beyond 5.021.38 as soon as a patch is made available by the vendor.

Proactive Monitoring: Review web server and API access logs for anomalous requests to the /api/proxy endpoint, specifically looking for external URLs passed as arguments to the url parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and block suspicious requests containing unexpected or external domains within the proxy API parameters.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the Exploit-DB entry 48240 and the ZSL-2020-5563 security advisory.

The presence of a publicly available proof-of-concept elevates the risk of exploitation for this vulnerability. Administrators and users of FIBARO Home Center systems must prioritize updating their firmware to the latest available release. Until updates are applied, restrict access to the web management interface to trusted networks only to prevent unauthorized access to the vulnerable proxy API.