by Kastro
Paper/Archive/CVE-2024-32651

CVE-2024-32651

dgtlmoon changedetection.io — Server Side Template Injection in Jinja2 allows Remote Command Execution

EPSS 84%public exploitCVSS 10.0
critical.is priorityof 100
60
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 99.7.997 × 2019.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service. There is a Server Side Template Injection (SSTI) in Jinja2 that allows Remote Command Execution on the server host. Attackers can run any system command without any restriction and they could use a reverse shell. The impact is critical as the attacker can completely takeover the server machine. This can be reduced if changedetection is behind a login page, but this isn't required by the application (not by default and not enforced).

Affected

ProductAffectedFixed inSource
changedetection.io<= 0.45.20–CNA
changedetection.io0.45.20–CISA-ADP

Scores by source

GitHub_M (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/dgtlmoon/changedetection.io/security/advisories/GHSA-4r7v-whpg-8rx3refgithub.com/dgtlmoon/changedetection.io/releases/tag/0.45.21refonsecurity.io/blog/server-side-template-injection-with-jinja2refblog.hacktivesecurity.com/index.php/2024/05/08/cve-2024-32651-server-side-template-injection-changedetection-io