GHSA-hcvp-2cc7-jrwr
Vulnerability from github
Published
2024-01-23 12:50
Modified
2024-09-13 17:38
Severity ?
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1.7 (Low) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Summary
changedetection.io API endpoint is not secured with API token
Details

Summary

API endpoint /api/v1/watch/<uuid>/history can be accessed by any unauthorized user.

Details

WatchHistory resource does not have @auth.check_token annotation, which means it can be accessed without providing x-api-key header.

https://github.com/dgtlmoon/changedetection.io/blob/9510345e01ea8e308c339163d8e8b030ce5ac7f1/changedetectionio/api/api_v1.py#L129-L156

PoC

  1. Get list of watch with x-api-key: sh $ curl -H "x-api-key: apikeyhere" http://localhost:5000/api/v1/watch {"uuid": ...}
  2. Call for history of snapshots without x-api-key. Expected - 401/403 error. Actual - list of snapshots is listed. sh $ curl http://localhost:5000/api/v1/watch/uuid/history {"timestamp": "/path/to/snapshot.txt"}

Impact

Anybody can check one's watch history. However, because unauthorized party first needs to know watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an impact on users' data privacy is minimal.

Show details on source website

To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.45.12"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "changedetection.io"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.39.14"
            },
            {
              "fixed": "0.45.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-23329"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-23T12:50:59Z",
    "nvd_published_at": "2024-01-19T20:15:13Z",
    "severity": "LOW"
  },
  "details": "### Summary\n\nAPI endpoint `/api/v1/watch/\u003cuuid\u003e/history` can be accessed by any unauthorized user.\n\n### Details\n\nWatchHistory resource does not have `@auth.check_token` annotation, which means it can be accessed without providing `x-api-key` header.\n\nhttps://github.com/dgtlmoon/changedetection.io/blob/9510345e01ea8e308c339163d8e8b030ce5ac7f1/changedetectionio/api/api_v1.py#L129-L156\n\n### PoC\n\n1. Get list of watch with `x-api-key`:\n```sh\n$ curl -H \"x-api-key: apikeyhere\" http://localhost:5000/api/v1/watch\n{\"uuid\": ...}\n```\n2. Call for history of snapshots without `x-api-key`. Expected - 401/403 error. Actual - list of snapshots is listed.\n```sh\n$ curl http://localhost:5000/api/v1/watch/uuid/history\n{\"timestamp\": \"/path/to/snapshot.txt\"}\n```\n\n### Impact\n\nAnybody can check one\u0027s watch history. However, because unauthorized party first needs to know watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an impact on users\u0027 data privacy is minimal.\n",
  "id": "GHSA-hcvp-2cc7-jrwr",
  "modified": "2024-09-13T17:38:17Z",
  "published": "2024-01-23T12:50:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-hcvp-2cc7-jrwr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23329"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dgtlmoon/changedetection.io/commit/402f1e47e78ecd155b1e90f30cce424ff7763e0f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dgtlmoon/changedetection.io"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dgtlmoon/changedetection.io/blob/9510345e01ea8e308c339163d8e8b030ce5ac7f1/changedetectionio/api/api_v1.py#L129-L156"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/changedetection-io/PYSEC-2024-15.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "changedetection.io API endpoint is not secured with API token"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.