Publish GHSA-6jrf-rcjf-245r

2026-05-22 18:04:22 -07:00 · 2024-11-07 22:02:11 +00:00
parent 3f18740c04
commit b28b014fa2
1 changed files with 80 additions and 0 deletions
@@ -0,0 +1,80 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6jrf-rcjf-245r",
+  "modified": "2024-11-07T22:00:59Z",
+  "published": "2024-11-07T22:00:58Z",
+  "aliases": [
+    "CVE-2024-51998"
+  ],
+  "summary": "changedetection.io path traversal using file URI scheme without supplying hostname",
+  "details": "### Summary\n\nThe validation for the file URI scheme falls short, and results in an attacker being able to read any file on the system. This issue only affects instances with a webdriver enabled, and `ALLOW_FILE_URI` false or not defined.\n\n### Details\n\nThe check used for URL protocol, `is_safe_url`, allows `file:` as a URL scheme:\n\nhttps://github.com/dgtlmoon/changedetection.io/blob/e0abf0b50507a8a3d0c1d8522ab23519b3e4cdf4/changedetectionio/model/Watch.py#L11-L13\n\nIt later checks if local files are permitted, but one of the preconditions for the check is that the URL starts with `file://`. The issue comes with the fact that the file URI scheme is not required to have double slashes.\n\n> A valid file URI must therefore begin with either `file:/path` (no hostname), `file:///path` (empty hostname), or `file://hostname/path`.\n> — [Wikipedia](https://en.wikipedia.org/wiki/File_URI_scheme#Number_of_slash_characters)\n\nhttps://github.com/dgtlmoon/changedetection.io/blob/e0abf0b50507a8a3d0c1d8522ab23519b3e4cdf4/changedetectionio/processors/__init__.py#L37-L41\n\n### PoC\n\n1. Open up a changedetection.io instance with a webdriver configured\n2. Create a new watch: `file:/etc/passwd` or a similar path for your operating system. Enable webdriver mode\n3. Wait for it to be checked\n4. Open preview\n5. Notice contents of the file\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "changedetection.io"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.47.6"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 0.47.5"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-6jrf-rcjf-245r"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/dgtlmoon/changedetection.io/commit/49bc982c697169c98b79698889fb9d26f6b3317f"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/dgtlmoon/changedetection.io"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/dgtlmoon/changedetection.io/blob/e0abf0b50507a8a3d0c1d8522ab23519b3e4cdf4/changedetectionio/model/Watch.py#L11-L13"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/dgtlmoon/changedetection.io/blob/e0abf0b50507a8a3d0c1d8522ab23519b3e4cdf4/changedetectionio/processors/__init__.py#L37-L41"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/dgtlmoon/changedetection.io/releases/tag/0.47.06"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-22"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-11-07T22:00:58Z",
+    "nvd_published_at": null
+  }
+}