CVE-2024-34061
published 2024-05-02CVE-2024-34061: changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. In affected versions Input in…
PriorityP427medium4.3CVSS 3.1
AVNACLPRNUIRSUCNILAN
EXPLOIT
EPSS
1.28%
66.4th percentile
changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. In affected versions Input in parameter notification_urls is not processed resulting in javascript execution in the application. A reflected XSS vulnerability happens when the user input from a URL or POST data is reflected on the page without being stored, thus allowing the attacker to inject malicious content. This issue has been addressed in version 0.45.22. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dgtlmoon | changedetection.io | < 0.45.22 | 0.45.22 |
| dgtlmoon | changedetection.io | >= 0 < 0.45.22 | 0.45.22 |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
changedetection.io Cross-site Scripting vulnerability
ghsa·2024-05-03
CVE-2024-34061 [MEDIUM] CWE-79 changedetection.io Cross-site Scripting vulnerability
changedetection.io Cross-site Scripting vulnerability
### Summary
Input in parameter notification_urls is not processed resulting in javascript execution in the application
### Details
changedetection.io version: v0.45.21
https://github.com/dgtlmoon/changedetection.io/blob/0.45.21/changedetectionio/forms.py#L226
```
for server_url in field.data:
if not apobj.add(server_url):
message = field.gettext('\'%s\' is not a valid AppRise URL.' % (server_url))
raise ValidationError(message)
```
### PoC
Setting > ADD Notification URL List
```
">
```
Requests
### Impact
A reflected XSS vulnerability happens when the user input from a URL or POST data is reflected on the page without being stored, thus allowing the attacker to inject malicious content
OSV
changedetection.io Cross-site Scripting vulnerability
osv·2024-05-03
CVE-2024-34061 [MEDIUM] changedetection.io Cross-site Scripting vulnerability
changedetection.io Cross-site Scripting vulnerability
### Summary
Input in parameter notification_urls is not processed resulting in javascript execution in the application
### Details
changedetection.io version: v0.45.21
https://github.com/dgtlmoon/changedetection.io/blob/0.45.21/changedetectionio/forms.py#L226
```
for server_url in field.data:
if not apobj.add(server_url):
message = field.gettext('\'%s\' is not a valid AppRise URL.' % (server_url))
raise ValidationError(message)
```
### PoC
Setting > ADD Notification URL List
```
">
```
Requests
### Impact
A reflected XSS vulnerability happens when the user input from a URL or POST data is reflected on the page without being stored, thus allowing the attacker to inject malicious content
No detection rules found.
Nuclei
Changedetection.io <=v0.45.21 - Cross-Site Scripting
nuclei·CVSS 4.3
CVE-2024-34061 [MEDIUM] Changedetection.io <=v0.45.21 - Cross-Site Scripting
Changedetection.io '
- 'is not a valid AppRise URL'
condition: and
- type: word
part: header
words:
- 'text/html'
- type: status
status:
- 200
extractors:
- type: regex
part: body
name: csrf_token
group: 1
regex:
- 'name="csrf_token" value="([^"]+)"'
internal: true
# digest: 4b0a00483046022100ee5398595af8533298bb2a8af6b82535c992ca115b4bd5cab209a65b2034178f022100907e4f401a68a879a392309bfd59d8f75673e9d8b4062f1c99ab52d9d78a999b:922c64590222798bb761d5b6d8e72950
https://github.com/dgtlmoon/changedetection.io/commit/c0f000b1d1ce03733460805dbbedde445fe2c762https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-pwgc-w4x9-gw67https://github.com/dgtlmoon/changedetection.io/commit/c0f000b1d1ce03733460805dbbedde445fe2c762https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-pwgc-w4x9-gw67
2024-05-02
Published