Missing Authorization in ZoneMinder - #VU158942

Vulnerability details

The vulnerability allows a remote user to modify the retention-protection state of arbitrary recorded events, including events belonging to monitors outside their authorized scope.

The vulnerability exists due to missing authorization checks in ZoneMinder's EventsController::archive() action when handling event archive requests. A remote user can send GET requests to /zm/api/events/archive/<id>.json with chosen numeric event identifiers using read-only Events = View permission to toggle the Archived flag without Events = Edit permission or per-monitor authorization, making preserved recordings eligible for automatic deletion or protecting arbitrary recordings from automatic purging.

Affected software

Remediation

External References

• https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-5v9h-ww7p-hxgv
• https://github.com/ZoneMinder/zoneminder/commit/3d5de347a

Related Security Bulletins

• Multiple vulnerabilities in ZoneMinder