OS Command Injection in ZoneMinder - #VU158948

Vulnerability details

The vulnerability allows a remote user to execute arbitrary operating system commands as the web server user on the ZoneMinder server.

The vulnerability exists due to improper neutralization of shell metacharacters in the wget() helper in web/includes/monitor_probe.php when processing camera discovery URLs containing user-controlled credentials. A remote user can submit a camera username such as a;touch /tmp/zm_probe_marker;# through the camera discovery request to inject shell commands into the URL passed to exec() and execute arbitrary commands as the web server user.

Exploitation requires Monitors Create or Edit permissions and a deployment where camera discovery reaches a wget()-based vendor helper, such as Hikvision, Avigilon, or Vivotek.

Affected software

Remediation

External References

• https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-745h-vg7c-73cg

Related Security Bulletins

• Multiple vulnerabilities in ZoneMinder