Unauthenticated RCE in snapshots

Impact

There's no permissions check on https://github.com/ZoneMinder/zoneminder/blob/master/web/includes/actions/snapshot.php#L25 and https://github.com/ZoneMinder/zoneminder/blob/master/web/includes/actions/snapshot.php#L36 is expecting an id to fetch an existing monitor but you can pass an object to create a new one instead. TriggerOn ends up calling shell_exec here

zoneminder/web/includes/Monitor.php

Lines 782 to 783 in 371f1ad

    
           $cmd = getZmuCommand($cmd.' -m '.$this->{'Id'}); 
        
           $output = shell_exec($cmd);

using the supplied Id

Patches

Fixed in 609b22a and 6ffd2bd aa495eda6be0f4d027283c6d5392e0c0dc07fb5d6.

We add validation to Monitor ID and require authentication before processing actions. In addition we validate Monitor ID before calling shell commands.

Workarounds

Apply patches manually.

Credit

UnblvR

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Unauthenticated RCE in snapshots

Package

Affected versions

Patched versions

Description

Impact

Patches

Workarounds

Credit

Severity

CVSS base metrics

CVE ID

Weaknesses

	$cmd = getZmuCommand($cmd.' -m '.$this->{'Id'});
	$output = shell_exec($cmd);