CVE-2024-51998: dgtlmoon changedetection.io Path Traversal

Vulnerability summary

CVE-2024-51998 is a high (CVSS 8.6) Path Traversal vulnerability in dgtlmoon changedetection.io. EPSS estimates a 0.69% chance of exploitation in the next 30 days, higher than 52.1% of scored vulnerabilities.

Timeline

1. 07-11-2024
   PublishedVulnerability first disclosed.
2. 08-11-2024
   Last modifiedVulnerability information updated.

Description

changedetection.io is a free open source web page change detection tool. The validation for the file URI scheme falls short, and results in an attacker being able to read any file on the system. This issue only affects instances with a webdriver enabled, and `ALLOW_FILE_URI` false or not defined. The check used for URL protocol, `is_safe_url`, allows `file:` as a URL scheme. It later checks if local files are permitted, but one of the preconditions for the check is that the URL starts with `file://`. The issue comes with the fact that the file URI scheme is not required to have double slashes. This issue has been addressed in version 0.47.06 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.