ZoneMinder up to 1.32.3 Log Message injection

Summaryinfo

A vulnerability was found in ZoneMinder up to 1.32.3. It has been classified as critical. This impacts an unknown function of the component Log Handler. This manipulation of the argument Message with the input User%20admin%20Logged%20in causes injection. This vulnerability appears as CVE-2019-7351. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability has been found in ZoneMinder up to 1.32.3 (Video Surveillance Software) and classified as critical. Affected by this vulnerability is an unknown code block of the component Log Handler. The manipulation of the argument message with the input value User%20admin%20Logged%20in leads to a injection vulnerability. The CWE definition for the vulnerability is CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Log Injection exists in ZoneMinder through 1.32.3, as an attacker can entice the victim to visit a specially crafted link, which in turn will inject a custom Log message provided by the attacker in the 'log' view page, as demonstrated by the message=User%20'admin'%20Logged%20in value.

The bug was discovered 01/24/2019. The weakness was presented 02/04/2019. This vulnerability is known as CVE-2019-7351 since 02/04/2019. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1055 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 11 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-130514, VDB-130512, VDB-130511 and VDB-130510 for similar entries. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Video Surveillance Software

Name

• ZoneMinder

Version

• 1.32.0
• 1.32.1
• 1.32.2
• 1.32.3

License

• open-source

Website

• Product: https://github.com/ZoneMinder/zoneminder/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion