CVE-2024-32651

2024-04-2600:15:08

CWE-1336

[email protected]

web.nvd.nist.gov

changedetection.io

ssti

jinja2

remote command execution

server takeover

security vulnerability

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.1%

JSON

changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service. There is a Server Side Template Injection (SSTI) in Jinja2 that allows Remote Command Execution on the server host. Attackers can run any system command without any restriction and they could use a reverse shell. The impact is critical as the attacker can completely takeover the server machine. This can be reduced if changedetection is behind a login page, but this isn’t required by the application (not by default and not enforced).

Affected configurations

Vulners

Node

dgtlmoonchangedetection.ioRange≤0.45.20

CNA Affected

[
  {
    "vendor": "dgtlmoon",
    "product": "changedetection.io",
    "versions": [
      {
        "version": "<= 0.45.20",
        "status": "affected"
      }
    ]
  }
]