GitStock

dgtlmoon/changedetection.io · Security

changedetection.io Path Traversal

GHSA ID
GHSA-cwgg-57xj-g77r
CVE ID
CVE-2024-51483
Severity
medium
Published
Updated
CVSS
6.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v3
6.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Description

Summary

When a WebDriver is used to fetch files source:file:///etc/passwd can be used to retrieve local system files, where the more traditional file:///etc/passwd gets blocked

Details

The root cause is the payload source:file:///etc/passwdpasses the regex here and also passes the check here where a traditional file:///etc/passwd would get blocked

PoC

CL-ChangeDetection.io Path Travsersal-311024-181039.pdf

Impact

It depends on where the webdriver is deployed but generally this is a high impact vulnerability

CWEs

  • CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

References

Open GitHub