Improper Authentication in dgtlmoon changedetection.io

A vulnerability has been identified in dgtlmoon changedetection.io versions up to 0.60.7. The issue exists within the check_authentication function located in the changedetectionio/flask_app.py file, which is part of the Authentication Hook component. This vulnerability stems from improper authentication logic, which may allow remote, unauthenticated attackers to bypass intended access controls. The vulnerability has been publicly disclosed with functional exploit code available. The vendor has not provided a patch or response regarding this issue as of the time of disclosure, making it critical for administrators to isolate the application from public access.

Impact

Successful exploitation allows a remote, unauthenticated attacker to bypass authentication mechanisms, potentially granting unauthorized access to the application's functionality. This could lead to sensitive data exposure, unauthorized modification of monitored URLs, and potential remote control of the changedetection.io instance.

Recommendation

1. Restrict network access to the changedetection.io instance by placing it behind a reverse proxy or VPN to prevent public access until an official patch is released.
2. Implement robust authentication at the network perimeter, such as Mutual TLS (mTLS) or OAuth2 via a web application firewall (WAF), to compensate for the vulnerability in the Authentication Hook component.
3. Monitor application logs for anomalous access patterns or unexpected authentication successes originating from suspicious external IP addresses.