Description
changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access internal addresses. Attackers can supply arbitrary internal URLs in the optional_value parameter to retrieve responses from restricted network locations.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| dgtlmoon | changedetection.io | ≤ 0.60.6 | — |
References
- Researcher write-up, finding 2 technical-description exploit
- action_goto_url calls page.goto with no address validation technical-description
- https://github.com/dgtlmoon/changedetection.io product
- VulnCheck Advisory: changedetection.io through 0.60.6 SSRF via browser-step Goto URL third-party-advisory