CVE-2024-23329: changedetection.io API endpoint is not secured with API token
Summary
API endpoint /api/v1/watch/<uuid>/history can be accessed by any unauthorized user.
Details
WatchHistory resource does not have @auth.checktoken annotation, which means it can be accessed without providing x-api-key header.
https://github.com/dgtlmoon/changedetection.io/blob/9510345e01ea8e308c339163d8e8b030ce5ac7f1/changedetectionio/api/apiv1.py#L129-L156
PoC
1. Get list of watch with x-api-key: sh $ curl -H "x-api-key: apikeyhere" http://localhost:5000/api/v1/watch {"uuid": ...} 2. Call for history of snapshots without x-api-key. Expected - 401/403 error. Actual - list of snapshots is listed. sh $ curl http://localhost:5000/api/v1/watch/uuid/history {"timestamp": "/path/to/snapshot.txt"}
Impact
Anybody can check one's watch history. However, because unauthorized party first needs to know watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an impact on users' data privacy is minimal.
Other sources
changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint /api/v1/watch/<uuid>/history can be accessed by any unauthorized user. As a result any unauthorized user can check one's watch history. However, because unauthorized party first needs to know a watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an impact on users' data privacy is minimal. This issue has been addressed in version 0.45.13. Users are advised to upgrade. There are no known workarounds for this vulnerability.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/changedetection.ioto a version that resolves this vulnerability.Fixed in 0.45.13 - Upgrade
Upgrade
changedetection.ioto a version that resolves this vulnerability.Fixed in 0.45.13
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23329?
CVE-2024-23329 has been classified as a medium severity vulnerability due to unauthorized access to sensitive user data.
How do I fix CVE-2024-23329?
To fix CVE-2024-23329, update changedetection.io to version 0.45.13 or later.
What versions are affected by CVE-2024-23329?
CVE-2024-23329 affects versions of changedetection.io from 0.39.14 to 0.45.12 inclusive.
What specific data can be accessed through CVE-2024-23329?
CVE-2024-23329 allows unauthorized users to access the watch history of any user.
Is authentication required to exploit CVE-2024-23329?
No, CVE-2024-23329 can be exploited without any authentication.