ZoneMinder HTTP POST Request /zm/index.php injection

Summaryinfo

A vulnerability categorized as critical has been discovered in ZoneMinder. The impacted element is an unknown function of the file /zm/index.php of the component HTTP POST Request Handler. Executing a manipulation can lead to injection. This vulnerability is handled as CVE-2022-39291. The attack can be executed remotely. Additionally, an exploit exists. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability has been found in ZoneMinder (Video Surveillance Software) (affected version unknown) and classified as critical. This vulnerability affects an unknown functionality of the file /zm/index.php of the component HTTP POST Request Handler. The manipulation with an unknown input leads to a injection vulnerability. The CWE definition for the vulnerability is CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. As an impact it is known to affect integrity, and availability. CVE summarizes:

ZoneMinder is a free, open source Closed-circuit television software application. Affected versions of zoneminder are subject to a vulnerability which allows users with "View" system permissions to inject new data into the logs stored by Zoneminder. This was observed through an HTTP POST request containing log information to the "/zm/index.php" endpoint. Submission is not rate controlled and could affect database performance and/or consume all storage resources. Users are advised to upgrade. There are no known workarounds for this issue.

The weakness was released 10/08/2022 as GHSA-cfcx-v52x-jh74. The advisory is shared for download at github.com. This vulnerability was named CVE-2022-39291 since 09/02/2022. Technical details and also a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1055.

It is possible to download the exploit at exploit-db.com. It is declared as proof-of-concept. By approaching the search of inurl:zm/index.php it is possible to find vulnerable targets with Google Hacking.

Applying the patch 34ffd92bf123070cab6c83ad4cfe6297dd0ed0b4 is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at Exploit-DB (51071). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Video Surveillance Software

Name

• ZoneMinder

License

• open-source

Website

• Product: https://github.com/ZoneMinder/zoneminder/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion