pysec - pysec-2024-15

pysec-2024-15

Vulnerability from pysec

Published

2024-01-19 20:15

Modified

2024-01-26 22:21

Severity ?

3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint /api/v1/watch/<uuid>/history can be accessed by any unauthorized user. As a result any unauthorized user can check one's watch history. However, because unauthorized party first needs to know a watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an impact on users' data privacy is minimal. This issue has been addressed in version 0.45.13. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "changedetection-io",
        "purl": "pkg:pypi/changedetection-io"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "402f1e47e78ecd155b1e90f30cce424ff7763e0f"
            }
          ],
          "repo": "https://github.com/dgtlmoon/changedetection.io",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0.39.14"
            },
            {
              "fixed": "0.45.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.39.14",
        "0.39.14.1",
        "0.39.15",
        "0.39.16",
        "0.39.17",
        "0.39.17.1",
        "0.39.17.2",
        "0.39.18",
        "0.39.19",
        "0.39.19.1",
        "0.39.20",
        "0.39.20.1",
        "0.39.20.2",
        "0.39.20.3",
        "0.39.20.4",
        "0.39.21",
        "0.39.21.1",
        "0.39.22",
        "0.39.22.1",
        "0.40.0",
        "0.40.0.1",
        "0.40.0.2",
        "0.40.0.3",
        "0.40.0.4",
        "0.40.1.0",
        "0.40.1.1",
        "0.40.2",
        "0.40.3",
        "0.41",
        "0.41.1",
        "0.42",
        "0.42.1",
        "0.42.2",
        "0.42.3",
        "0.43.1",
        "0.43.2",
        "0.44",
        "0.44.1",
        "0.45",
        "0.45.1",
        "0.45.11",
        "0.45.12",
        "0.45.2",
        "0.45.3",
        "0.45.4",
        "0.45.5",
        "0.45.6",
        "0.45.7",
        "0.45.7.1",
        "0.45.7.2",
        "0.45.7.3",
        "0.45.8",
        "0.45.8.1",
        "0.45.9"
      ]
    }
  ],
  "aliases": [
    "CVE-2024-23329",
    "GHSA-hcvp-2cc7-jrwr"
  ],
  "details": " changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint `/api/v1/watch/\u003cuuid\u003e/history` can be accessed by any unauthorized user. As a result any unauthorized user can check one\u0027s watch history. However, because unauthorized party first needs to know a watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an impact on users\u0027 data privacy is minimal. This issue has been addressed in version 0.45.13. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
  "id": "PYSEC-2024-15",
  "modified": "2024-01-26T22:21:10.756741+00:00",
  "published": "2024-01-19T20:15:00+00:00",
  "references": [
    {
      "type": "EVIDENCE",
      "url": "https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-hcvp-2cc7-jrwr"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-hcvp-2cc7-jrwr"
    },
    {
      "type": "FIX",
      "url": "https://github.com/dgtlmoon/changedetection.io/commit/402f1e47e78ecd155b1e90f30cce424ff7763e0f"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

cve-2024-23329

Vulnerability from cvelistv5

Published

2024-01-19 19:49

Modified

2024-11-13 17:15

Severity ?

3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

changedetection.io API endpoint is not secured with API token

References

▼	URL	Tags
	https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-hcvp-2cc7-jrwr	x_refsource_CONFIRM
	https://github.com/dgtlmoon/changedetection.io/commit/402f1e47e78ecd155b1e90f30cce424ff7763e0f	x_refsource_MISC

Impacted products

Vendor

Product

Version

▼

dgtlmoon

changedetection.io

Version: >= 0.39.14, < 0.45.13

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:59:32.297Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-hcvp-2cc7-jrwr",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-hcvp-2cc7-jrwr"
          },
          {
            "name": "https://github.com/dgtlmoon/changedetection.io/commit/402f1e47e78ecd155b1e90f30cce424ff7763e0f",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/dgtlmoon/changedetection.io/commit/402f1e47e78ecd155b1e90f30cce424ff7763e0f"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-23329",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-13T17:15:02.044508Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-13T17:15:21.418Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "changedetection.io",
          "vendor": "dgtlmoon",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.39.14, \u003c 0.45.13"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": " changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint `/api/v1/watch/\u003cuuid\u003e/history` can be accessed by any unauthorized user. As a result any unauthorized user can check one\u0027s watch history. However, because unauthorized party first needs to know a watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an impact on users\u0027 data privacy is minimal. This issue has been addressed in version 0.45.13. Users are advised to upgrade. There are no known workarounds for this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-19T19:49:54.624Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-hcvp-2cc7-jrwr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-hcvp-2cc7-jrwr"
        },
        {
          "name": "https://github.com/dgtlmoon/changedetection.io/commit/402f1e47e78ecd155b1e90f30cce424ff7763e0f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dgtlmoon/changedetection.io/commit/402f1e47e78ecd155b1e90f30cce424ff7763e0f"
        }
      ],
      "source": {
        "advisory": "GHSA-hcvp-2cc7-jrwr",
        "discovery": "UNKNOWN"
      },
      "title": "changedetection.io API endpoint is not secured with API token"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-23329",
    "datePublished": "2024-01-19T19:49:54.624Z",
    "dateReserved": "2024-01-15T15:19:19.441Z",
    "dateUpdated": "2024-11-13T17:15:21.418Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

ghsa-hcvp-2cc7-jrwr

Vulnerability from github

Published

2024-01-23 12:50

Modified

2024-09-13 17:38

Severity ?

3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1.7 (Low) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

Summary

changedetection.io API endpoint is not secured with API token

Details

Summary

API endpoint /api/v1/watch/<uuid>/history can be accessed by any unauthorized user.

Details

WatchHistory resource does not have @auth.check_token annotation, which means it can be accessed without providing x-api-key header.

https://github.com/dgtlmoon/changedetection.io/blob/9510345e01ea8e308c339163d8e8b030ce5ac7f1/changedetectionio/api/api_v1.py#L129-L156

PoC

Get list of watch with x-api-key: sh $ curl -H "x-api-key: apikeyhere" http://localhost:5000/api/v1/watch {"uuid": ...}
Call for history of snapshots without x-api-key. Expected - 401/403 error. Actual - list of snapshots is listed. sh $ curl http://localhost:5000/api/v1/watch/uuid/history {"timestamp": "/path/to/snapshot.txt"}

Impact

Anybody can check one's watch history. However, because unauthorized party first needs to know watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an impact on users' data privacy is minimal.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.45.12"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "changedetection.io"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.39.14"
            },
            {
              "fixed": "0.45.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-23329"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-23T12:50:59Z",
    "nvd_published_at": "2024-01-19T20:15:13Z",
    "severity": "LOW"
  },
  "details": "### Summary\n\nAPI endpoint `/api/v1/watch/\u003cuuid\u003e/history` can be accessed by any unauthorized user.\n\n### Details\n\nWatchHistory resource does not have `@auth.check_token` annotation, which means it can be accessed without providing `x-api-key` header.\n\nhttps://github.com/dgtlmoon/changedetection.io/blob/9510345e01ea8e308c339163d8e8b030ce5ac7f1/changedetectionio/api/api_v1.py#L129-L156\n\n### PoC\n\n1. Get list of watch with `x-api-key`:\n```sh\n$ curl -H \"x-api-key: apikeyhere\" http://localhost:5000/api/v1/watch\n{\"uuid\": ...}\n```\n2. Call for history of snapshots without `x-api-key`. Expected - 401/403 error. Actual - list of snapshots is listed.\n```sh\n$ curl http://localhost:5000/api/v1/watch/uuid/history\n{\"timestamp\": \"/path/to/snapshot.txt\"}\n```\n\n### Impact\n\nAnybody can check one\u0027s watch history. However, because unauthorized party first needs to know watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an impact on users\u0027 data privacy is minimal.\n",
  "id": "GHSA-hcvp-2cc7-jrwr",
  "modified": "2024-09-13T17:38:17Z",
  "published": "2024-01-23T12:50:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-hcvp-2cc7-jrwr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23329"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dgtlmoon/changedetection.io/commit/402f1e47e78ecd155b1e90f30cce424ff7763e0f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dgtlmoon/changedetection.io"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dgtlmoon/changedetection.io/blob/9510345e01ea8e308c339163d8e8b030ce5ac7f1/changedetectionio/api/api_v1.py#L129-L156"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/changedetection-io/PYSEC-2024-15.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "changedetection.io API endpoint is not secured with API token"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

pysec-2024-15

Vulnerability from pysec

cve-2024-23329

Vulnerability from cvelistv5

ghsa-hcvp-2cc7-jrwr

Vulnerability from github

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature