GHSA-8757-69j2-hx56: changedetection.io has an Arbitrary Local File Read via a crafted backup restore
DetailsThe vulnerability is caused by trusting attacker-controlled snapshot paths restored from backup files.The vulnerable flow starts in the backup restore logic. When a backup ZIP is restored, the application extracts the archive and copies each restored watch UUID directory directly into the live datastore using `shutil.copytree(entry.path, dst_dir)`. This preserves attacker-controlled files inside the restored watch directory, including `history.txt`.Relevant code:[changedetectionio/blueprint/backups/restore.py](https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/blueprint/backups/restore.py#L132)[changedetectionio/blueprint/backups/restore.py](https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/blueprint/backups/restore.py#L141)After restore, the application parses `history.txt` in the watch `history` property. This is the core trust-boundary issue.Relevant code:[changedetectionio/model/Watch.py](https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/model/Watch.py#L460)[changedetectionio/model/Watch.py](https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/model/Watch.py#L471)[changedetectionio/model/Watch.py](https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/model/Watch.py#L478)The relevant logic is effectively:This has the following security consequence:If the `history.txt` value is only a filename, it is resolved safely under `self.data_dir`.If the value contains path separators, it is treated as a path reference rather than a watch-local snapshot name.If that external path already exists, it is preserved unchanged.As a result, a malicious restored `history.txt` entry such as:`1776969105,/etc/passwd`will be accepted if the referenced file exists and is readable by the application process.The second vulnerable step is in `get_history_snapshot()`. Once the untrusted path has been accepted into the watch history, the application reads the resolved path directly without enforcing that it remains inside the watch directory.Relevant code:[changedetectionio/model/Watch.py](https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/model/Watch.py#L554)That function eventually performs direct file reads such as:The third step is reachability. The trusted history entry is consumed by both the Preview UI and the watch history API.Relevant code:[changedetectionio/blueprint/ui/preview.py](https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/blueprint/ui/preview.py#L77)[changedetectionio/api/Watch.py](https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/api/Watch.py#L263)In the Preview flow, the application selects the latest history timestamp and calls:In the API flow, the application also calls:This creates the following end-to-end exploit chain:An attacker supplies a crafted backup ZIP.The restore process preserves attacker-controlled `history.txt`.The `history.txt` parser accepts an absolute or out-of-directory path if that path exists.Preview or the history API dereferences the stored path directly.The application returns the contents of the targeted local file.The root cause is that imported history entries are treated as trusted filesystem paths instead of being restricted to safe basenames under `watch.data_dir`.PoCThe following proof of concept demonstrates the end-to-end exploit chain. It assumes the attacker has gained access to the backup restore functionality to upload the crafted archive.Create a normal watch in the UI, for example:Trigger at least one successful check so the watch generates a valid history entry and can later be included in a backup.Go to the `Backups` section and create a backup archive.Extract the backup archive and identify the watch UUID directory that contains the target watch's `watch.json`. For example:Open that watch directory and edit `history.txt`.Replace the latest history entry with a path to an existing local file that is readable by the application process. For example:If the timestamp differs in the extracted backup, keep the original latest timestamp and only replace the filename/path portion.Example:becomes:Repack the backup so that the UUID directories are located at the root of the ZIP archive.Important:Do not add an extra parent directory layer when repacking.The archive root should contain directories such as:In the UI, restore the modified backup and enable replacement of existing watches with the same UUID.After restore completes, open `Preview` for the restored watch.The application will read the attacker-controlled path from `history.txt` and display the contents of the referenced local file instead of the original watch snapshot.Observed result:The Preview page returns the content of the attacker-selected local file.Expected result:The application should reject absolute paths or out-of-directory paths restored from `history.txt`.Snapshot history should be restricted to files within the watch's own data directory.Optional API verification:The same issue can also be confirmed through the watch history API by requesting the modified timestamp after restore.The API returns the same file content because it also calls `watch.get_history_snapshot(timestamp=timestamp)` on the trusted history entry.ImpactThis is an arbitrary local file disclosure vulnerability reachable through malicious backup restore content.Who is impacted:Deployments where the application process has read access to sensitive local system files.Docker or host-mounted environments where secrets, config files, or operational artifacts are explicitly readable by the service.What can be exposed:**Arbitrary System Files:** Core operating system files (e.g., `/etc/passwd`, `/proc/self/environ`), system-level configurations, and host metrics.**Application Data:** Internal records and files residing under the /datastore directory.**Secrets & Artifacts:** Application-local configuration files, API tokens, database credentials, and other sensitive artifacts accessible to the application process.By accessing the backup restore functionality and importing a crafted archive, an attacker can exploit the application's fail-open path validation. The confidentiality impact is exceptionally high because, once the payload is ingested, the application can be manipulated to disclose arbitrary local system files and highly sensitive environment variables directly through standard UI or API responses.RecommendationThe application should treat all paths restored from `history.txt` as untrusted input.The root cause is in [changedetectionio/model/Watch.py](https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/model/Watch.py#L460), where values containing path separators are currently accepted as filesystem paths and preserved if the referenced file already exists.The fix should be:Never trust absolute or external paths from `history.txt`.Normalize every history entry to `os.path.basename(v)`.Join the normalized filename to `self.data_dir`.Skip the entry if the resolved file does not exist inside the watch directory.Suggested code change:This ensures restored history entries can only reference files inside the watch's own data directory and prevents arbitrary local file reads through Preview or the history API.
CVSS v3.1: 7.5