SIP is a free Raspberry Pi based Python program for controlling irrigation systems (sprinkler, drip, hydroponic, etc). It uses web technology to provide an intuitive user interface (UI) in several languages. The UI can be accessed in your favorite browser on desktop, laptop, and mobile devices. SIP has also been used to control pumps, lights, and other Irrigation related equipment.
The application accepts an attacker-supplied callback URL and, when the optional Node-RED plugin is installed, later issues server-side HTTP requests to that URL without validating it. This can be exploited to make the device send requests to arbitrary internal or external systems on the attacker's behalf, reaching services that are otherwise not directly accessible. When the optional passphrase is not enabled (factory default) configuring the URL and triggering the request require no authentication, and where the passphrase is enabled it defaults to 'opendoor'.