ghsa-4c3j-3h7v-22q9
Vulnerability from github
Summary
A Stored Cross Site Scripting is present in the changedetection.io Watch update API due to unsufficient security checks.
Details
Tested on changedetection.io version v0.50.24
console
REPOSITORY TAG IMAGE ID CREATED SIZE
ghcr.io/dgtlmoon/changedetection.io latest 0367276509a0 23 hours ago 599MB
When a user tries to add an unsafe URL as a Watch in the changedetection.io UI, the action is blocked with the error message "Watch protocol is not permitted by SAFE_PROTOCOL_REGEX or incorrect URL format".
This is catched by the function validate_url(test_url).
python
def validate_url(test_url):
# ...
from .model.Watch import is_safe_url
if not is_safe_url(test_url):
# This should be wtforms.validators.
raise ValidationError('Watch protocol is not permitted by SAFE_PROTOCOL_REGEX or incorrect URL format')
When instead the Watch API is used, this check is not performed resulting in unsafe URLs added as Watch.
PoC
Update an existing watch with an unsafe URL
console
curl -X PUT "http://example.site/api/v1/watch/1242e1c5-d59e-4352-0078-203a55b21282" \
-H "x-api-key: XXX" \
-H "Content-Type: application/json" \
-d '{
"url": "javascript:alert(document.domain)",
"title": "XSS PoC",
"paused": false
}'
Impact
Two scenarios are possibile:
- An attacker can insert a new watch with an arbitrary URL which really points to a web page. Once the HTML content is retrieved, the attacker updates the URL with a JavaScript payload.
- An attacker substitutes the URL in an existing watch with a new URL that is in reality a JavaScript payload.
When the user clicks on Preview and then on the malicious link, the JavaScript malicious code is executed.
Credits
Edoardo Ottavianelli @edoardottt
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "changedetection.io"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.50.34"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-62780"
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2025-11-12T21:24:57Z",
"nvd_published_at": "2025-11-10T22:15:36Z",
"severity": "LOW"
},
"details": "### Summary\n\nA Stored Cross Site Scripting is present in the changedetection.io Watch update API due to unsufficient security checks.\n\n### Details\n\nTested on changedetection.io version *v0.50.24*\n\n```console\nREPOSITORY TAG IMAGE ID CREATED SIZE\nghcr.io/dgtlmoon/changedetection.io latest 0367276509a0 23 hours ago 599MB\n```\n\nWhen a user tries to add an unsafe URL as a Watch in the changedetection.io UI, the action is blocked with the error message \"Watch protocol is not permitted by SAFE_PROTOCOL_REGEX or incorrect URL format\".\nThis is catched by the function `validate_url(test_url)`.\n\n```python\ndef validate_url(test_url):\n # ...\n from .model.Watch import is_safe_url\n if not is_safe_url(test_url):\n # This should be wtforms.validators.\n raise ValidationError(\u0027Watch protocol is not permitted by SAFE_PROTOCOL_REGEX or incorrect URL format\u0027)\n```\n\nWhen instead the Watch API is used, this check is not performed resulting in unsafe URLs added as Watch.\n\n### PoC\n\nUpdate an existing watch with an unsafe URL\n```console\ncurl -X PUT \"http://example.site/api/v1/watch/1242e1c5-d59e-4352-0078-203a55b21282\" \\\n -H \"x-api-key: XXX\" \\\n -H \"Content-Type: application/json\" \\\n -d \u0027{\n \"url\": \"javascript:alert(document.domain)\",\n \"title\": \"XSS PoC\",\n \"paused\": false\n }\u0027\n```\n\n### Impact\n\nTwo scenarios are possibile:\n\n1. An attacker can insert a new watch with an arbitrary URL which really points to a web page. Once the HTML content is retrieved, the attacker updates the URL with a JavaScript payload.\n2. An attacker substitutes the URL in an existing watch with a new URL that is in reality a JavaScript payload.\n\nWhen the user clicks on *Preview* and then on the malicious link, the JavaScript malicious code is executed.\n\n\u003cimg width=\"1200\" height=\"643\" alt=\"poc1\" src=\"https://github.com/user-attachments/assets/db81e0c7-b6d3-4332-b15d-a688a48c3227\" /\u003e\n\u003cbr\u003e\n\u003cimg width=\"1200\" height=\"643\" alt=\"poc2\" src=\"https://github.com/user-attachments/assets/e704b37c-d339-4322-9fc0-ad50dd86b31d\" /\u003e\n\n\n\n### Credits\n\nEdoardo Ottavianelli @edoardottt",
"id": "GHSA-4c3j-3h7v-22q9",
"modified": "2025-11-12T21:24:57Z",
"published": "2025-11-12T21:24:57Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-4c3j-3h7v-22q9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62780"
},
{
"type": "WEB",
"url": "https://github.com/dgtlmoon/changedetection.io/issues/3562"
},
{
"type": "WEB",
"url": "https://github.com/dgtlmoon/changedetection.io/pull/3564"
},
{
"type": "PACKAGE",
"url": "https://github.com/dgtlmoon/changedetection.io"
},
{
"type": "WEB",
"url": "https://github.com/dgtlmoon/changedetection.io/releases/tag/0.50.34"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "changedetection.io: Stored XSS in Watch update via API"
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.