Summary

The integration.all tRPC endpoint in Homarr is exposed as a publicProcedure, allowing unauthenticated users to retrieve a complete list of configured integrations. This metadata includes sensitive information such as internal service URLs, integration names, and service types.

Details

The vulnerability is caused by an overly permissive access control configuration for the integration list procedure.

1. Exposed Procedure: In packages/api/src/router/integration/integration-router.ts, the all procedure is defined using publicProcedure:

   // packages/api/src/router/integration/integration-router.ts
   export const integrationRouter = createTRPCRouter({
     all: publicProcedure
       .output(z.array(integrationSchema))
       .query(async ({ ctx }) => {
         // ... fetches and returns all integrations
       }),

2. Sensitive Metadata Leak: The returned integrationSchema includes fields like url, which often contains internal IP addresses, local hostnames, or private subdomains for services that Homarr integrates with (e.g., Pi-hole, Plex, Sonarr, Docker).

PoC

Send a GET request to the integration.all endpoint:

curl -G 'http://127.0.0.1:7575/api/trpc/integration.all' \
  --data-urlencode 'batch=1' \
  --data-urlencode 'input={"0":{"json":null,"meta":{"values":["undefined"]}}}'

The response will contain a JSON array of all configured integrations and their internal URLs.

Impact

Vulnerability Type: Information Disclosure
Impacted Parties: Homarr administrators whose instances are exposed to untrusted networks.
Effect:

• Leak of internal network topology and service discovery.
• Disclosure of internal hostnames and IP addresses.
• Identification of service versions and types configured in the environment, aiding in further targeted attacks.