CVE-2024-43891: Local File Read via Path Traversal in changedetection.io Backup Restore

Vulnerability Summary: Arbitrary Local File Read via crafted backup restore Vulnerability Overview CVE ID: CVE-2024-43891 Severity: High (7.5/10) Affected Versions: <= 0.54.10 Fixed Version: 0.55.1 This vulnerability stems from the application incorrectly trusting attacker-controlled snapshot paths when restoring backup files. When a backup ZIP is restored, the application extracts the archive and copies each snapshot UUID directory directly to the database. Subsequently, the application parses paths from the file. If a path contains a path separator, it is treated as a reference to a local snapshot rather than a filename. Exploitation Chain: 1. The attacker provides a ZIP backup containing a malicious . 2. The restoration process preserves the attacker-controlled path. 3. The application directly reads this path, leading to arbitrary local file read. Impact Scope Affected Component: Attack Vector: Network Attack Complexity: Low Required Privileges: None User Interaction: None Confidentiality Impact: High (Can read sensitive system files, configuration files, application data, etc.) Integrity Impact: None Availability Impact: None Remediation The application should treat all restored paths from as untrusted input. Remediation Recommendations: 1. Do not trust absolute or external paths from . 2. Normalize each history entry using . 3. Concatenate the normalized filename with . 4. Skip the entry if the resolved file is not within the watch directory. Suggested Code Fix:

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-43891: Local File Read via Path Traversal in changedetection.io Backup Restore

More from this source