CVE-2024-23329

Executive Summary

CVE-2024-23329 is a vulnerability in changedetection.io, an open-source tool for monitoring website content changes. The vulnerability resides in the API endpoint /api/v1/watch/<uuid>/history, which lacks proper authorization checks. This allows any unauthenticated user to access the watch history of any watch, provided they know the watch's UUID. While the impact is limited to reading paths to snapshot files on the server, it still constitutes a breach of data privacy. The issue has been fixed in version 0.45.13. The EPSS score is 0.0%, indicating a very low probability of exploitation in the wild.

Supply Chain & Package Security

This vulnerability affects the changedetection.io application, which is distributed as a Python package (PyPI). Users should ensure they are using the latest version from PyPI or the official GitHub repository to mitigate this risk.

CVSS Breakdown & Threat Level

• CVSS Score: 3.7 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) – Limited information disclosure (paths to snapshot files).
• Integrity (I): None (N) – No data modification is possible.
• Availability (A): None (N) – No impact on system availability.

Threat Level: Low. The vulnerability requires knowledge of a specific watch UUID, and the disclosed information is limited to file paths.

Deep Dive & Mechanics

The vulnerability is an authorization bypass (CWE-862) in the API endpoint /api/v1/watch/<uuid>/history. This endpoint is designed to return the history of snapshots for a specific watch, identified by its UUID. The flaw is that the endpoint does not verify if the requesting user is authorized to view that watch's history. Any unauthenticated user can send a GET request to this endpoint and receive a list of snapshot file paths.

The watch UUID is a unique identifier generated for each watch. While not easily guessable, it can be leaked through other means (e.g., in logs, URLs, or other API responses). Once an attacker obtains a valid UUID, they can query the history endpoint.

The response from the endpoint contains only paths to snapshot files on the server (e.g., /snapshots/abc123.html). This does not directly expose the content of the snapshots, but it does reveal the existence and timing of changes, which could be sensitive information.

Vulnerable vs. Patched Code

Vulnerable Code (before 0.45.13): The API endpoint likely lacked any authentication or authorization check. A simplified example:

@app.route('/api/v1/watch/<uuid>/history')
def watch_history(uuid):
    # No authentication check
    history = get_watch_history(uuid)
    return jsonify(history)

Patched Code (0.45.13 and later): The fix adds an authorization check to ensure the requesting user is authenticated and authorized to view the watch's history.

@app.route('/api/v1/watch/<uuid>/history')
@login_required
def watch_history(uuid):
    watch = get_watch(uuid)
    if not watch or watch.user_id != current_user.id:
        abort(403)
    history = get_watch_history(uuid)
    return jsonify(history)

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of changedetection.io (version < 0.45.13).
• A valid watch UUID (e.g., obtained from a previous data leak or by enumerating UUIDs).

Exploitation Steps:

1. Identify a target changedetection.io instance.
2. Obtain a watch UUID (e.g., via social engineering, log analysis, or brute-forcing if UUIDs are predictable).
3. Send a GET request to the vulnerable endpoint:

   curl -X GET "http://target.com/api/v1/watch/known-uuid-here/history"
   

4. The response will contain a list of snapshot file paths:

   {
     "history": [
       "/snapshots/abc123.html",
       "/snapshots/def456.html"
     ]
   }
   

Note: No public exploit code is available for this CVE.

Blue Team (Defense & Detection)

Detection:

• Monitor for unauthorized access attempts to /api/v1/watch/*/history endpoints.
• Look for requests without valid authentication tokens or session cookies.
• Alert on multiple failed attempts to access different UUIDs (potential enumeration).

Prevention:

• Upgrade to changedetection.io version 0.45.13 or later.
• Implement network segmentation to restrict access to the API.
• Use a Web Application Firewall (WAF) to block requests to the vulnerable endpoint from untrusted sources.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /api/v1/watch/<uuid>/history without authentication headers.
  • Repeated requests with different UUIDs in the path (enumeration attempts).
• File IOCs:
  • Unauthorized access to snapshot files in the /snapshots/ directory.
• Log IOCs:
  • Access logs showing 200 responses to /api/v1/watch/*/history from unauthenticated users.

Detection Engineering

YARA Rule

rule CVE_2024_23329_Changedetection_History_Access
{
    meta:
        description = "Detects unauthorized access to changedetection.io watch history API"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-23329"
    strings:
        $api_path = "/api/v1/watch/"
        $history_suffix = "/history"
    condition:
        $api_path and $history_suffix
}

Sigma Rule

title: Unauthorized Access to Changedetection.io Watch History
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to access the watch history API endpoint without authentication
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-23329
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-stem|startswith: '/api/v1/watch/'
        cs-uri-stem|endswith: '/history'
    condition: selection
falsepositives:
    - Legitimate API calls from authenticated users
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-23329 - Unauthorized changedetection.io Watch History Access"; flow:to_server; http.uri; content:"/api/v1/watch/"; distance:0; content:"/history"; distance:0; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update changedetection.io to version 0.45.13 or later.
2. Restrict Access: If immediate upgrade is not possible, restrict network access to the API endpoint using a firewall or reverse proxy.
3. Monitor Logs: Review access logs for any unauthorized access attempts to the /api/v1/watch/*/history endpoint.

Long-Term Measures:

• Implement proper authentication and authorization for all API endpoints.
• Conduct regular security audits and penetration testing.
• Follow the principle of least privilege for API access.

Workarounds:

• No official workarounds are available. Upgrading is the only recommended solution.

Valters IT