CVE-2024-32651: changedetection.io SSTI RCE Vulnerability

CVE-2024-32651 Overview

CVE-2024-32651 is a Server Side Template Injection (SSTI) vulnerability in changedetection.io, an open source web page change detection, website watcher, restock monitor, and notification service. The vulnerability exists in the Jinja2 template engine implementation and allows unauthenticated attackers to execute arbitrary system commands on the server host with no restrictions, including establishing reverse shells for persistent access.

Critical Impact

This vulnerability enables complete server takeover through unauthenticated remote command execution. Attackers can execute any system command without restriction, potentially compromising all data and services on the affected host.

Affected Products

• changedetection.io versions prior to 0.45.21
• Self-hosted instances without authentication enabled
• Docker deployments with exposed network interfaces

Discovery Timeline

• 2024-04-26 - CVE-2024-32651 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-32651

Vulnerability Analysis

This Server Side Template Injection (SSTI) vulnerability occurs within the Jinja2 templating engine used by changedetection.io. Jinja2 is a widely-used Python template engine that, when improperly configured, can allow attackers to inject malicious template directives that execute arbitrary Python code on the server.

The vulnerability is particularly dangerous because changedetection.io does not require authentication by default, meaning any attacker with network access to the application can exploit this flaw. Once exploited, the attacker gains the ability to execute commands with the same privileges as the application process, which could include root access depending on deployment configuration.

The scope of this vulnerability extends beyond the vulnerable component itself, as successful exploitation can impact other systems and resources accessible from the compromised server.

Root Cause

The root cause is classified under CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine). The application fails to properly sanitize or escape user-controlled input before passing it to the Jinja2 template rendering engine. This allows malicious template expressions to be interpreted and executed by the server rather than being treated as plain text.

In Jinja2, template expressions enclosed in double curly braces {{ }} or statement tags {% %} are evaluated by the template engine. Without proper input validation and sandboxing, attackers can leverage Python's object introspection capabilities to escape the template context and access dangerous functions like os.system() or subprocess.Popen().

Attack Vector

The attack is conducted over the network without requiring any authentication or user interaction. An attacker can craft malicious input containing Jinja2 template syntax that, when processed by the application, executes arbitrary system commands.

Typical SSTI payloads in Jinja2 exploit Python's method resolution order (MRO) to traverse object hierarchies and access restricted modules. Attackers commonly use techniques like accessing __class__.__mro__ to reach the base object class, then iterating through __subclasses__() to find classes that provide file or command execution capabilities.

Once command execution is achieved, attackers typically establish persistence through reverse shells, allowing interactive access to the compromised system. The lack of default authentication in changedetection.io significantly amplifies the risk, as instances exposed to the internet are immediately vulnerable without any barrier to exploitation.

For detailed technical analysis and exploitation techniques, refer to the Hacktive Security Blog Post and the OnSecurity Blog Analysis.

Detection Methods for CVE-2024-32651

Indicators of Compromise

• Unusual template syntax patterns in application logs containing Jinja2 expressions like {{, {%, __class__, __mro__, or __subclasses__
• Unexpected outbound network connections from the changedetection.io process suggesting reverse shell activity
• Process spawning anomalies where the application creates child processes for system commands like /bin/sh, /bin/bash, nc, curl, or wget
• Web access logs showing requests with encoded or obfuscated payloads targeting template injection vectors

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block SSTI payloads containing Python object introspection patterns
• Monitor application logs for template rendering errors or exceptions that may indicate injection attempts
• Deploy endpoint detection and response (EDR) solutions to identify suspicious command execution chains originating from the web application process
• Utilize SentinelOne's behavioral AI to detect anomalous process trees where web server processes spawn shell interpreters

Monitoring Recommendations

• Enable verbose logging for the changedetection.io application to capture all template rendering operations
• Configure network monitoring to alert on unexpected egress connections from application servers
• Implement file integrity monitoring on the server to detect unauthorized modifications
• Set up alerts for authentication failures if authentication has been enabled as a mitigation

How to Mitigate CVE-2024-32651

Immediate Actions Required

• Upgrade changedetection.io to version 0.45.21 or later immediately
• Enable authentication for all changedetection.io instances to add a barrier against exploitation
• Review server access logs for evidence of prior exploitation attempts
• If compromise is suspected, isolate the affected system and conduct forensic analysis

Patch Information

The vulnerability has been addressed in changedetection.io version 0.45.21. The patch implements proper input sanitization and restricts the template engine's capabilities to prevent arbitrary code execution. Users should update immediately by pulling the latest release from the official repository.

For detailed patch information, see the GitHub Release Notes and the GitHub Security Advisory.

Workarounds

• Enable authentication on changedetection.io instances to prevent unauthenticated access (note: this reduces but does not eliminate risk if credentials are compromised)
• Restrict network access to the application using firewall rules, allowing only trusted IP addresses
• Deploy the application behind a reverse proxy with rate limiting and request filtering capabilities
• Run changedetection.io in an isolated container or virtual machine with minimal privileges to limit blast radius

# Example: Enable authentication and restrict network access
# Add authentication by configuring environment variables
export CHANGEDETECTION_PASSWORD="your-strong-password-here"

# Restrict access via iptables (example for Linux)
iptables -A INPUT -p tcp --dport 5000 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 5000 -j DROP