Timing Side-Channel in changedetection.io

Executive Summary

This vulnerability is a timing attack in changedetection.io up to version 0.60.7. It occurs in the password verification function where the system compares a user-provided password with a stored hash using a standard comparison operator. This operator stops comparing bytes as soon as a mismatch is found, causing response times to vary based on how many leading bytes match. Attackers can exploit this by measuring response times to gradually reconstruct the correct password hash and bypass authentication.

Useful 0 Not Useful 0

Detection Guidance

To detect this timing attack vulnerability in changedetection.io, monitor login response times for variations in failed attempts. Use tools like curl to send repeated login requests and measure response latency. Look for patterns where response times correlate with password similarity. Example command: for i in {1..100}; do time curl -X POST -d 'username=admin&password=test' http://target/login; done. Compare response times across different password inputs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could remotely exploit this to gain unauthorized access to accounts by recovering the password hash through timing analysis. This could lead to data breaches, unauthorized changes to monitored websites, or exposure of sensitive information handled by changedetection.io. The attack requires some technical skill but is feasible given published exploit methods.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA due to its effect on authentication security. Timing attacks on password verification may expose user credentials, violating GDPR's data protection principles and HIPAA's safeguards for protected health information. Organizations using affected versions of changedetection.io may face compliance risks if user data is compromised through this flaw.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update changedetection.io to the latest version if available. As a temporary fix, modify the check_password() function in flask_app.py to use constant-time comparison like hmac.compare_digest() instead of ==. Add rate limiting to the /login endpoint to prevent brute-force attacks. Disable the login endpoint if not essential.

Useful 0 Not Useful 0