github - ghsa-4c3j-3h7v-22q9

GHSA-4C3J-3H7V-22Q9

Vulnerability from github – Published: 2025-11-12 21:24 – Updated: 2025-11-12 21:24

Summary

changedetection.io: Stored XSS in Watch update via API

Details

Summary

A Stored Cross Site Scripting is present in the changedetection.io Watch update API due to unsufficient security checks.

Details

Tested on changedetection.io version v0.50.24

REPOSITORY                            TAG       IMAGE ID       CREATED        SIZE
ghcr.io/dgtlmoon/changedetection.io   latest    0367276509a0   23 hours ago   599MB

When a user tries to add an unsafe URL as a Watch in the changedetection.io UI, the action is blocked with the error message "Watch protocol is not permitted by SAFE_PROTOCOL_REGEX or incorrect URL format". This is catched by the function validate_url(test_url).

def validate_url(test_url):
    # ...
    from .model.Watch import is_safe_url
    if not is_safe_url(test_url):
        # This should be wtforms.validators.
        raise ValidationError('Watch protocol is not permitted by SAFE_PROTOCOL_REGEX or incorrect URL format')

When instead the Watch API is used, this check is not performed resulting in unsafe URLs added as Watch.

PoC

Update an existing watch with an unsafe URL

curl -X PUT "http://example.site/api/v1/watch/1242e1c5-d59e-4352-0078-203a55b21282" \
  -H "x-api-key: XXX" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "javascript:alert(document.domain)",
    "title": "XSS PoC",
    "paused": false
  }'

Impact

Two scenarios are possibile:

An attacker can insert a new watch with an arbitrary URL which really points to a web page. Once the HTML content is retrieved, the attacker updates the URL with a JavaScript payload.
An attacker substitutes the URL in an existing watch with a new URL that is in reality a JavaScript payload.

When the user clicks on Preview and then on the malicious link, the JavaScript malicious code is executed.

poc1
poc2

Credits

Edoardo Ottavianelli @edoardottt

Severity ?

3.5 (Low)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "changedetection.io"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.50.34"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-62780"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-11-12T21:24:57Z",
    "nvd_published_at": "2025-11-10T22:15:36Z",
    "severity": "LOW"
  },
  "details": "### Summary\n\nA Stored Cross Site Scripting is present in the changedetection.io Watch update API due to unsufficient security checks.\n\n### Details\n\nTested on changedetection.io version *v0.50.24*\n\n```console\nREPOSITORY                            TAG       IMAGE ID       CREATED        SIZE\nghcr.io/dgtlmoon/changedetection.io   latest    0367276509a0   23 hours ago   599MB\n```\n\nWhen a user tries to add an unsafe URL as a Watch in the changedetection.io UI, the action is blocked with the error message \"Watch protocol is not permitted by SAFE_PROTOCOL_REGEX or incorrect URL format\".\nThis is catched by the function `validate_url(test_url)`.\n\n```python\ndef validate_url(test_url):\n    # ...\n    from .model.Watch import is_safe_url\n    if not is_safe_url(test_url):\n        # This should be wtforms.validators.\n        raise ValidationError(\u0027Watch protocol is not permitted by SAFE_PROTOCOL_REGEX or incorrect URL format\u0027)\n```\n\nWhen instead the Watch API is used, this check is not performed resulting in unsafe URLs added as Watch.\n\n### PoC\n\nUpdate an existing watch with an unsafe URL\n```console\ncurl -X PUT \"http://example.site/api/v1/watch/1242e1c5-d59e-4352-0078-203a55b21282\" \\\n  -H \"x-api-key: XXX\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\n    \"url\": \"javascript:alert(document.domain)\",\n    \"title\": \"XSS PoC\",\n    \"paused\": false\n  }\u0027\n```\n\n### Impact\n\nTwo scenarios are possibile:\n\n1. An attacker can insert a new watch with an arbitrary URL which really points to a web page. Once the HTML content is retrieved, the attacker updates the URL with a JavaScript payload.\n2. An attacker substitutes the URL in an existing watch with a new URL that is in reality a JavaScript payload.\n\nWhen the user clicks on *Preview* and then on the malicious link, the JavaScript malicious code is executed.\n\n\u003cimg width=\"1200\" height=\"643\" alt=\"poc1\" src=\"https://github.com/user-attachments/assets/db81e0c7-b6d3-4332-b15d-a688a48c3227\" /\u003e\n\u003cbr\u003e\n\u003cimg width=\"1200\" height=\"643\" alt=\"poc2\" src=\"https://github.com/user-attachments/assets/e704b37c-d339-4322-9fc0-ad50dd86b31d\" /\u003e\n\n\n\n### Credits\n\nEdoardo Ottavianelli @edoardottt",
  "id": "GHSA-4c3j-3h7v-22q9",
  "modified": "2025-11-12T21:24:57Z",
  "published": "2025-11-12T21:24:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-4c3j-3h7v-22q9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62780"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dgtlmoon/changedetection.io/issues/3562"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dgtlmoon/changedetection.io/pull/3564"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dgtlmoon/changedetection.io"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dgtlmoon/changedetection.io/releases/tag/0.50.34"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "changedetection.io: Stored XSS in Watch update via API"
}

CVE-2025-62780 (GCVE-0-2025-62780)

Vulnerability from cvelistv5 – Published: 2025-11-10 21:18 – Updated: 2025-11-10 21:43

Summary

changedetection.io is a free open source web page change detection tool. A Stored Cross Site Scripting is present in changedetection.io Watch update API in versions prior to 0.50.34 due to insufficient security checks. Two scenarios are possible. In the first, an attacker can insert a new watch with an arbitrary URL which really points to a web page. Once the HTML content is retrieved, the attacker updates the URL with a JavaScript payload. In the second, an attacker substitutes the URL in an existing watch with a new URL that is in reality a JavaScript payload. When the user clicks on *Preview* and then on the malicious link, the JavaScript malicious code is executed. Version 0.50.34 fixes the issue.

Severity ?

3.5 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

URL

Tags

https://github.com/dgtlmoon/changedetection.io/se…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	dgtlmoon	changedetection.io	Affected: < 0.50.34

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-62780",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-10T21:43:49.371343Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-10T21:43:52.020Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-4c3j-3h7v-22q9"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "changedetection.io",
          "vendor": "dgtlmoon",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.50.34"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "changedetection.io is a free open source web page change detection tool. A Stored Cross Site Scripting is present in changedetection.io Watch update API in versions prior to 0.50.34 due to insufficient security checks. Two scenarios are possible. In the first, an attacker can insert a new watch with an arbitrary URL which really points to a web page. Once the HTML content is retrieved, the attacker updates the URL with a JavaScript payload. In the second, an attacker substitutes the URL in an existing watch with a new URL that is in reality a JavaScript payload. When the user clicks on *Preview* and then on the malicious link, the JavaScript malicious code is executed. Version 0.50.34 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-10T21:18:52.945Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-4c3j-3h7v-22q9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-4c3j-3h7v-22q9"
        }
      ],
      "source": {
        "advisory": "GHSA-4c3j-3h7v-22q9",
        "discovery": "UNKNOWN"
      },
      "title": "changedetection.io vulnerable to stored XSS in Watch update via API"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-62780",
    "datePublished": "2025-11-10T21:18:52.945Z",
    "dateReserved": "2025-10-22T18:55:48.007Z",
    "dateUpdated": "2025-11-10T21:43:52.020Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-4C3J-3H7V-22Q9

Summary

Details

PoC

Impact

Credits

CVE-2025-62780 (GCVE-0-2025-62780)

Tags

Sightings

Nomenclature