Server-Side Request Forgery (SSRF) in ZoneMinder - #VU158959

Vulnerability details

The vulnerability allows a remote attacker to access loopback services through the ZoneMinder server, disclose sensitive information, and potentially disrupt internal service availability.

The vulnerability exists due to insufficient validation of redirect destinations in the proxy= handler in web/views/image.php when fetching user-supplied URLs. The handler checks the initial host address, but PHP's HTTP stream wrapper automatically follows redirects without revalidating their destinations. A remote attacker can submit a crafted GET request referencing an allowed host that redirects to 127.0.0.1 to bypass the server-side request forgery guard, retrieve image content from loopback services, and potentially disrupt those services.

When ZM_OPT_USE_AUTH=1, exploitation requires the canEdit('Monitors') permission.

Affected software

Remediation

External References

• https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-v2qc-p8cq-g4pc

Related Security Bulletins

• Multiple vulnerabilities in ZoneMinder