CVE-2023-24769

Vulnerability

Description Changedetection.io versions prior to v0.40.1.1 contain a stored cross-site scripting (XSS) vulnerability in the main page's "Add a new change detection watch" function. The vulnerability arises because the application does not properly sanitize the URL parameter before storing it, allowing an attacker to inject malicious web scripts or HTML. This input is later rendered on the watch list page without adequate escaping, leading to stored XSS [1][2].

Exploitation

An attacker can exploit this by crafting a payload containing malicious JavaScript and injecting it into the URL field when creating a new watch. The payload is then stored in the application's database and executed in the browser of any user who views the watch list page. No special privileges are required other than the ability to add a watch, which is a standard user function [1][2].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to session hijacking, defacement of the watch list page, theft of sensitive information displayed on the page, or forced actions on behalf of the victim. The vulnerability is classified as stored XSS, meaning the malicious code persists for all users who access the affected page [2][3].

Mitigation

The issue has been addressed in changedetection.io version 0.40.1.1. The fix includes restricting allowed URL protocols (e.g., HTTP, HTTPS, FTP) by default, with an environment variable SAFE_PROTOCOL_REGEX available for customization. Users are strongly advised to upgrade to the latest version. No workaround is provided for unpatched installations [4].