changedetection.io Stored Cross-Site Scripting Vulnerability in Watch Update API

A stored cross-site scripting vulnerability has been identified in changedetection.io versions prior to 0.50.34. The issue arises in the Watch update API, where insufficient security checks allow attackers to inject JavaScript payloads. This can be done either by adding a new watch with a URL that points to a web page, which is later updated with a JavaScript payload, or by modifying an existing watch's URL to include a JavaScript payload. When the user previews the watch, the injected JavaScript is executed.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected JavaScript payloads are executed in the context of the user.

Reproduction

To reproduce this vulnerability, update an existing watch through the Watch update API by sending a PUT request with a JavaScript payload in the URL field. Include a valid API key in the request headers.

Remediation

Users are advised to update to changedetection.io version 0.50.34 or later, where this vulnerability has been fixed.