Authentication Bypass in changedetection.io via Brute Force

Executive Summary

This vulnerability involves the /login route in changedetection.io using a single PBKDF2-HMAC-SHA256 hash to verify passwords without rate limiting or lockout mechanisms. Since there are no per-user accounts and only one shared password, a brute-force attack can succeed and grant full administrative access, including API token control.

Useful 0 Not Useful 0

Detection Guidance

Check for repeated failed login attempts to /login route. Monitor for unusual administrative access patterns or API token regeneration events. Inspect logs for PBKDF2-HMAC-SHA256 hash submission attempts.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gain full administrative access to the system by brute-forcing the shared password. This would allow them to view or regenerate API tokens, potentially leading to unauthorized data access or system control.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Lack of proper authentication controls may result in non-compliance with data protection regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the shared password system immediately. Implement per-user accounts with strong passwords. Add rate limiting to the /login route. Replace PBKDF2-HMAC-SHA256 with a more secure hashing mechanism.

Useful 0 Not Useful 0