CVE-2024-51483

Deeper analysis

changedetection.io is an open source web page change detection tool that supports multiple fetch methods including WebDriver-based retrieval. Prior to version 0.47.5 the application failed to sanitize source URLs supplied to the WebDriver processor, allowing an attacker to supply a value such as source:file:///etc/passwd that bypasses the normal file:// scheme block and reads arbitrary local files on the host running the changedetection service. The issue is tracked as CWE-22 and carries a CVSS 4.0 score of 6.9.

An unauthenticated remote attacker who can reach the changedetection.io web interface can create or modify a watch, supply the WebDriver source prefix, and retrieve sensitive files such as /etc/passwd or application configuration. Successful exploitation yields local file disclosure without requiring authentication or user interaction.

The project security advisory GHSA-cwgg-57xj-g77r and the accompanying patch release 0.47.5 address the flaw by tightening input validation inside the Watch model and processor initialization code. The EPSS score has remained flat at 0.39 with no material post-disclosure rise.