+ "details": "### Summary\nThree security vulnerabilities were identified in [changedetection.io](http://changedetection.io/) through source code review and live validation against a locally deployed Docker instance. All vulnerabilities were confirmed exploitable on the latest version (0.53.6) it was additionally validated at scale against 500 internet-facing instances discovered via FOFA search engine, producing 5K+ confirmed detections using a custom Nuclei template, demonstrating widespread real-world impact.\nThe RSS single-watch endpoint reflects the UUID path parameter directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser parses and executes injected JavaScript.\n\n### Details\nFile: `changedetectionio/blueprint/rss/single_watch.py (lines ~45 and ~50)`\n\nThe UUID parameter from the URL path is interpolated into the response body using an f-string with no escaping:\n\n### Line ~45\n```\nwatch = datastore.data['watching'].get(uuid)\nif not watch:\n return f\"Watch with UUID {uuid} not found\", 404 # ← No escaping, Content-Type: text/html\n```\n\n### Line ~50\n```\nif len(dates) < 2:\n return f\"Watch {uuid} does not have enough history snapshots...\", 400 # ← Same issue\nFlask's default Content-Type for plain string responses is text/html; charset=utf-8, so any HTML/JavaScript in {uuid} is rendered by the browser.\n```\n\n## Attack Vector\nThe attack requires a valid RSS access token, which is a 32-character hex string exposed in the HTML <link> tag on the homepage without authentication:\n\n<!-- Visible in page source of any unauthenticated instance -->\n<link rel=\"alternate\" type=\"application/rss+xml\" href=\"/rss?token=f2bb14e20ff01bad83a743cf21b5df95\">\n\nAttacker visits the target's homepage if it unauthenticathed and extracts the RSS token from the <link> tag\nCrafts a malicious URL:\n\n1. http://target:5000/rss/watch/%3Cimg%20src%3Dx%20onerror%3Dalert(document.cookie)%3E?token=EXTRACTED_TOKEN\n2. Sends the link to a victim who has an active session on the [changedetection.io](http://changedetection.io/) instance\n3. When the victim clicks the link, the server responds with:\n4. Watch with UUID not found\n\nThe browser renders the <img> tag, the onerror fires, and JavaScript executes in the victim's session context\n\n### PoC\nRequest:\n\n```\nGET /rss/watch/%3Cimg%20src%3Dx%20onerror%3Dalert(document.cookie)%3E?token=223e7edbbfee2268f5abb5344919054e HTTP/1.1\nHost: [127.0.0.1:5000](http://127.0.0.1:5000/)\n```\n\nResponse:\n\n```\nHTTP/1.1 404 NOT FOUND\nContent-Type: text/html; charset=utf-8\n```\n\nWatch with UUID not found\n\n\n<img width=\"1918\" height=\"1032\" alt=\"image\" src=\"https://github.com/user-attachments/assets/1633b167-e4ec-4705-a110-18fad7826fc9\" />\n\nThe XSS payload is reflected unescaped in an HTML response. The browser executes alert(document.cookie).\n\nLots of intances over internet affected to this.\n<img width=\"1465\" height=\"721\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f54160d4-abd1-4e8d-b845-f85e53e79325\" />\n\n\n### Impact\n- Session cookie theft via document.cookie exfiltration\n- Account takeover if session cookies lack HttpOnly flag\n- Phishing via crafted links that appear to originate from a trusted [changedetection.io](http://changedetection.io/) instance\n- Token is obtainable without authentication from the homepage <link> tag, lowering the barrier to exploitation\n\nchangedetection.io can work with developer teams to validate and address these issues. Please confirm receipt of this report and inform changedetection.io of the preferred timeline for coordinating the fix.\n\nRoberto Nunes",
![advisory-database[bot]](https://avatars.githubusercontent.com/in/21409?v=4&size=40){kind=avatar}
0 commit comments