Server-Side Template Injection Affecting changedetection.io package, versions [,0.45.21)
Threat Intelligence
Exploit Maturity
Mature
EPSS
0.07% (30th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-CHANGEDETECTIONIO-6674055
- published 26 Apr 2024
- disclosed 26 Apr 2024
- credit Edoardo Ottavianelli
Introduced: 26 Apr 2024
CVE-2024-32651 Open this link in a new tabHow to fix?
Upgrade changedetection.io to version 0.45.21 or higher.
Overview
changedetection.io is a Website change detection and monitoring service
Affected versions of this package are vulnerable to Server-Side Template Injection due to improper handling of template data. An attacker can execute arbitrary commands on the server by crafting malicious input that exploits the template rendering process.
Notes:
- This can be reduced if
changedetectionaccess is protected by login page with a password, but this isn't required by the application (not by default and not enforced).
2)This vulnerability is particularly severe as it allows for complete server takeover without any restrictions, such as running a reverse shell.
CVSS Scores
version 3.1