CVE-2024-32651: dgtlmoon changedetection.io

Vulnerability summary

CVE-2024-32651 is a critical (CVSS 10.0) vulnerability in dgtlmoon changedetection.io. EPSS estimates a 83.60% chance of exploitation in the next 30 days, higher than 99.6% of scored vulnerabilities.

Timeline

1. 25-04-2024
   PublishedVulnerability first disclosed.
2. 13-02-2025
   Last modifiedVulnerability information updated.

Description

changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service. There is a Server Side Template Injection (SSTI) in Jinja2 that allows Remote Command Execution on the server host. Attackers can run any system command without any restriction and they could use a reverse shell. The impact is critical as the attacker can completely takeover the server machine. This can be reduced if changedetection is behind a login page, but this isn't required by the application (not by default and not enforced).

• CWE-1336Improper Neutralization of Special Elements Used in a Template EngineThe product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.