changedetection.io Anfällig für unsachgemäße Eingabevalidierung, die zu LFR/Path Traversal führt

The primary impact of this vulnerability is unauthorized access to sensitive files. An attacker could leverage the Path Traversal flaw to read files outside of the intended application directory, potentially exposing configuration files, source code, or other sensitive data. Successful exploitation could lead to information disclosure, and in some cases, could be a stepping stone for further attacks if the exposed files contain credentials or other valuable information. The vulnerability stems from inadequate sanitization of user-provided input used to construct file paths, allowing attackers to bypass security checks using techniques like file:../../../etc/passwd.

Users running changedetection-io versions prior to 0.48.05, particularly those deploying the application in environments with sensitive data or where the server's file system is accessible via the web. Shared hosting environments where users have limited control over the application's configuration are also at increased risk.

• python / server: Examine application logs for requests containing suspicious file paths, particularly those using ../ sequences. Use grep to search for patterns like file:../../../ in access logs. • generic web: Use curl or wget to attempt accessing files outside the intended directory structure (e.g., curl http://your-changedetection-io-instance/file:../../../etc/passwd). • python / server: Monitor process execution for unexpected file access patterns using tools like auditd or sysdig.

1. 2024-12-27Disclosure

   disclosure

1. Reserviert2024-12-26
2. Veröffentlicht2024-12-27
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-56509 is to upgrade to version 0.48.05 or later. If upgrading is not immediately feasible, consider implementing stricter input validation on the url parameter within the application code. While not a complete solution, this can provide a temporary layer of defense. Review and harden file permissions to restrict access to sensitive files. Monitor application logs for suspicious file access attempts, particularly those involving unusual path patterns. After upgrading, confirm the fix by attempting to access a file outside the intended directory via the vulnerable endpoint and verifying that access is denied.