Products
changedetection.io
Source
security-advisories@github.com
Tags
CVE-2024-32651 details
Last Modified : April 26, 2024, 12:58 p.m.
Description
changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service. There is a Server Side Template Injection (SSTI) in Jinja2 that allows Remote Command Execution on the server host. Attackers can run any system command without any restriction and they could use a reverse shell. The impact is critical as the attacker can completely takeover the server machine. This can be reduced if changedetection is behind a login page, but this isn't required by the application (not by default and not enforced).
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10.0 |
|---|
Weakness
| Weakness | Name | Description |
|---|
CVSS Data
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Base Score
10.0
Exploitability Score
Impact Score
Base Severity
CRITICAL
Vector String : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
| URL | Source |
|---|---|
| https://github.com/dgtlmoon/changedetection.io/releases/tag/0.45.21 | security-advisories@github.com |
| https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-4r7v-whpg-8rx3 | security-advisories@github.com |
| https://www.onsecurity.io/blog/server-side-template-injection-with-jinja2 | security-advisories@github.com |