CVE-2025-52558

Executive Summary

CVE-2025-52558 is a cross-site scripting (XSS) vulnerability identified in changedetection.io, an open-source web page change detection and monitoring service. The vulnerability exists in versions prior to 0.50.4 and stems from insufficient sanitization of errors generated by filters used in website page change detection watches. An attacker can exploit this flaw by crafting a malicious filter that, when processed, injects arbitrary JavaScript into the application's interface, leading to XSS attacks. This could allow an attacker to steal session cookies, deface pages, or perform actions on behalf of a legitimate user. The vulnerability has been patched in version 0.50.4.

Supply Chain & Package Security

changedetection.io is a Python-based application distributed via PyPI and Docker. The vulnerability does not directly affect the supply chain, but users should ensure they are using the latest patched version (0.50.4) from official sources. Verify the integrity of the package using checksums provided by the maintainers.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Base Score: 6.1)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must interact with the malicious content.
• Scope (S): Changed (C) – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): Low (L) – Limited data modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The vulnerability requires user interaction but can lead to session hijacking or phishing attacks.

Deep Dive & Mechanics

The vulnerability resides in the filter processing logic of changedetection.io. When a user configures a watch with a filter (e.g., CSS selector or regex), the application applies the filter to the fetched page content. If the filter itself contains an error (e.g., malformed regex), the error message is returned to the user interface without proper sanitization. An attacker can craft a filter that triggers an error containing malicious JavaScript. When the error is displayed in the browser, the script executes in the context of the changedetection.io application, leading to XSS.

Root Cause: Lack of output encoding or sanitization of error messages from filter processing.

Attack Flow:

1. Attacker creates a watch with a malicious filter (e.g., (?<script>alert(1))).
2. The filter engine fails to parse the regex and generates an error message containing the malicious payload.
3. The error message is rendered in the user's browser without escaping.
4. The injected script executes, allowing the attacker to steal cookies or perform actions.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 0.50.4):

# In filter processing logic
try:
    result = apply_filter(content, filter_string)
except Exception as e:
    # Error message directly rendered without sanitization
    return f"Filter error: {str(e)}"

Patched Code (0.50.4):

import html

# In filter processing logic
try:
    result = apply_filter(content, filter_string)
except Exception as e:
    # Error message sanitized before rendering
    safe_error = html.escape(str(e))
    return f"Filter error: {safe_error}"

The patch uses html.escape() to encode HTML special characters, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• changedetection.io instance running version < 0.50.4
• Ability to create a watch with a custom filter

Exploitation Steps:

1. Log in to the changedetection.io instance.
2. Create a new watch with a target URL (any public page).
3. In the "CSS/JSON/Regex Filter" field, enter a malicious filter that triggers an error, e.g.:

   (?<script>alert(document.cookie))
   

4. Save the watch. The filter engine will fail to parse the regex and generate an error.
5. The error message will be displayed in the watch's status or log, executing the injected script.
6. The script can be modified to exfiltrate cookies to an attacker-controlled server.

Example Payload:

(?<img src=x onerror=alert(1)>)

Blue Team

Detection:

• Monitor for unusual filter strings containing HTML/JavaScript payloads.
• Check application logs for filter errors containing suspicious characters.
• Use web application firewall (WAF) rules to block common XSS patterns in filter inputs.

Mitigation:

• Immediately upgrade to version 0.50.4 or later.
• If upgrade is not possible, apply a virtual patch by adding input validation for filter strings (e.g., reject strings containing <, >, ", ', or &).
• Implement Content Security Policy (CSP) headers to limit script execution.

Indicators of Compromise (IOCs)

• Network: HTTP requests to changedetection.io with filter parameters containing HTML/JavaScript payloads.
• Logs: Application logs showing filter errors with embedded script tags.
• File System: No specific file-based IOCs.
• Memory: No specific memory-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2025_52558_XSS_Filter {
    meta:
        description = "Detects XSS attempts via filter errors in changedetection.io"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-52558"
    strings:
        $xss_payload = /(?<![a-zA-Z0-9])<script[^>]*>.*?<\/script>/i
        $xss_event = /on\w+\s*=\s*['\"].*?['\"]/i
        $filter_error = "Filter error"
    condition:
        $filter_error and ($xss_payload or $xss_event)
}

Sigma Rule

title: CVE-2025-52558 XSS via Filter Error in changedetection.io
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6e
status: experimental
description: Detects XSS attempts via filter errors in changedetection.io
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-52558
logsource:
    category: application
    product: changedetection.io
detection:
    selection:
        message|contains: "Filter error"
    keywords:
        - "<script"
        - "onerror"
        - "onload"
        - "javascript:"
    condition: selection and keywords
falsepositives:
    - Legitimate filter errors with non-malicious content
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-52558 XSS via Filter Error in changedetection.io"; flow:to_server,established; content:"Filter error"; http_server_body; pcre:"/(?<![a-zA-Z0-9])<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade changedetection.io to version 0.50.4 or later.
2. If upgrade is not possible, implement a WAF rule to block filter strings containing HTML/JavaScript.
3. Review and sanitize all user-supplied filter inputs.

Long-term Measures:

• Implement Content Security Policy (CSP) headers to restrict script execution.
• Conduct regular security audits of the application.
• Enable logging and monitoring for suspicious filter errors.

Patch Details:

• The fix is included in version 0.50.4, available on GitHub and PyPI.
• Verify the integrity of the update using the provided checksums.

Valters IT
Securing Digital Frontiers