registry / iobroker.aura / 0.33.3

iobroker.aura@0.33.3

Modern visualization dashboard for ioBroker

AI Security Review

scanned 4h ago · by lpm-firewall-ai

The adapter starts an HTTP(S) dashboard server with an arbitrary HTTP(S) reverse-proxy route and a calendar URL fetch relay. These are runtime features, not install-time behavior, but they could be abused if the service is exposed to untrusted clients.

Static reason

No blocking static signals were detected.

Trigger

Adapter runtime; requests to `/proxy` or writes to `calendar.request`.

Impact

Potential SSRF/open-proxy and header-forwarding exposure; no confirmed malware execution or exfiltration chain.

Mechanism

User-controlled outbound HTTP(S) proxying and calendar retrieval.

Rationale

No source evidence supports malicious intent or install-time compromise. The unrestricted runtime proxy and URL fetch features remain a concrete security risk that warrants a warning rather than a block.

Evidence

package.jsonmain.jslib/webExtension.jsio-package.jsonwww/assets/echarts-Cv-_nZ52.js

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`main.js` exposes `/proxy` for caller-supplied `http`/`https` URLs without a destination allowlist.

iobroker.aura@0.33.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code