Path traversal using file URI scheme without supplying hostname in changedetection.io

CVE-2024-51998

What is CVE-2024-51998?

A critical vulnerability in Changedetection.io, an open-source web page change detection tool, exposes users to unauthorized file access. This issue arises from insufficient validation of the file URI scheme, permitting attackers to read any file on affected systems when webdriver is enabled and the configuration for ALLOW_FILE_URI is set to false or left undefined. The vulnerability is linked to the method used for URL protocol checks, which inadequately manages the file: scheme. Despite a local file permit check, the vulnerability stems from the requirement for the file URI format, which does not consistently enforce double slashes. Users are strongly encouraged to upgrade to version 0.47.06 or later, as no workarounds exist to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References