PT-2024-35086 · Unknown · Changedetection.Io

Erb3 · Published 2024-11-07 · Updated 2024-11-13 · CVE-2024-51998

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions changedetection.io versions prior to 0.47.06

Description The validation for the file URI scheme in changedetection.io falls short, allowing an attacker to read any file on the system. This issue only affects instances with a webdriver enabled and ALLOW FILE URI set to false or not defined. The is safe url check allows file: as a URL scheme, but later checks for local file permission require the URL to start with file://. However, the file URI scheme does not require double slashes, leading to the vulnerability.

Recommendations For versions prior to 0.47.06, upgrade to version 0.47.06 to address the issue. As a temporary workaround, consider disabling the webdriver or setting ALLOW FILE URI to true until the upgrade can be applied. Restrict access to the is safe url function to minimize the risk of exploitation. Avoid using the file: scheme in URLs until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-51998

GHSA-6JRF-RCJF-245R

Affected Products

Changedetection.Io

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51998.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-51998 · Security Note
• https://osv.dev/vulnerability/GHSA-6jrf-rcjf-245r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-51998 · Vendor Advisory
• https://github.com/dgtlmoon/changedetection.io · Note
• https://github.com/dgtlmoon/changedetection.io/releases/tag/0.47.06 · Note
• https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-6jrf-rcjf-245r · Note
• https://github.com/dgtlmoon/changedetection.io/commit/49bc982c697169c98b79698889fb9d26f6b3317f · Note
• https://github.com/dgtlmoon/changedetection.io/blob/e0abf0b50507a8a3d0c1d8522ab23519b3e4cdf4/changedetectionio/processors/__init__.py#L37-L41 · Note
• https://github.com/dgtlmoon/changedetection.io/blob/e0abf0b50507a8a3d0c1d8522ab23519b3e4cdf4/changedetectionio/model/Watch.py#L11-L13 · Note
• https://twitter.com/cracbot/status/1856577786342978018 · Twitter Post
• https://t.me/cvenotify/101004 · Telegram Post
• https://twitter.com/CVEnew/status/1854670341798310321 · Twitter Post
• https://t.me/cvedetector/10148 · Telegram Post
• https://twitter.com/CveFindCom/status/1854675512779481224 · Twitter Post