Summary

Input in parameter notification_urls is not processed resulting in javascript execution in the application

Details

changedetection.io version: v0.45.21

https://github.com/dgtlmoon/changedetection.io/blob/0.45.21/changedetectionio/forms.py#L226

        for server_url in field.data:
            if not apobj.add(server_url):
                message = field.gettext('\'%s\' is not a valid AppRise URL.' % (server_url))
                raise ValidationError(message)

PoC

Setting > ADD Notification URL List

"><img src=x onerror=alert(document.domain)>

Requests

Impact

A reflected XSS vulnerability happens when the user input from a URL or POST data is reflected on the page without being stored, thus allowing the attacker to inject malicious content

References

• GHSA-pwgc-w4x9-gw67
• https://nvd.nist.gov/vuln/detail/CVE-2024-34061
• dgtlmoon/changedetection.io@c0f000b
• https://github.com/dgtlmoon/changedetection.io/blob/0.45.21/changedetectionio/forms.py#L226