Cross-site scripting in ZoneMinder - #VU153363

Vulnerability details

The vulnerability allows a remote user to execute arbitrary JavaScript in a viewer's browser.

The vulnerability exists due to improper neutralization of stored input in web/skins/classic/views/js/montage.js.php when rendering a monitor's DefaultPlayer value in the montage view. A remote user can submit a specially crafted Monitor.DefaultPlayer value through POST /api/monitors/edit/{id}.json to execute arbitrary JavaScript in a viewer's browser.

Exploitation requires monitor editing permission and a separate viewer opening the montage view. The monitor must be visible to that viewer and have Capturing set to a value other than None. The injected code executes within the page's existing nonce-bearing script.

Affected software

Remediation

External References

• https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-r44j-mvj8-cg9w
• https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.5

Related Security Bulletins

• Multiple vulnerabilities in ZoneMinder