ZoneMinder up to 1.36.32/1.37.32 web/ajax/modal.php untrusted search path

Summaryinfo

A vulnerability was found in ZoneMinder up to 1.36.32/1.37.32. It has been rated as critical. The impacted element is an unknown function of the file web/ajax/modal.php. This manipulation causes untrusted search path. This vulnerability is tracked as CVE-2023-26038. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in ZoneMinder up to 1.36.32/1.37.32 (Video Surveillance Software). It has been declared as critical. Affected by this vulnerability is an unknown function of the file web/ajax/modal.php. The manipulation with an unknown input leads to a untrusted search path vulnerability. The CWE definition for the vulnerability is CWE-426. The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain a Local File Inclusion (Untrusted Search Path) vulnerability via web/ajax/modal.php, where an arbitrary php file path can be passed in the request and loaded. This issue is patched in versions 1.36.33 and 1.37.33.

The weakness was disclosed 02/25/2023 as GHSA-wrx3-r8c4-r24w. It is possible to read the advisory at github.com. This vulnerability is known as CVE-2023-26038 since 02/17/2023. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1574 according to MITRE ATT&CK.

By approaching the search of inurl:web/ajax/modal.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.36.33 or 1.37.33 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Video Surveillance Software

Name

• ZoneMinder

Version

• 1.36.0
• 1.36.1
• 1.36.2
• 1.36.3
• 1.36.4
• 1.36.5
• 1.36.6
• 1.36.7
• 1.36.8
• 1.36.9
• 1.36.10
• 1.36.11
• 1.36.12
• 1.36.13
• 1.36.14
• 1.36.15
• 1.36.16
• 1.36.17
• 1.36.18
• 1.36.19
• 1.36.20
• 1.36.21
• 1.36.22
• 1.36.23
• 1.36.24
• 1.36.25
• 1.36.26
• 1.36.27
• 1.36.28
• 1.36.29
• 1.36.30
• 1.36.31
• 1.36.32
• 1.37.0
• 1.37.1
• 1.37.2
• 1.37.3
• 1.37.4
• 1.37.5
• 1.37.6
• 1.37.7
• 1.37.8
• 1.37.9
• 1.37.10
• 1.37.11
• 1.37.12
• 1.37.13
• 1.37.14
• 1.37.15
• 1.37.16
• 1.37.17
• 1.37.18
• 1.37.19
• 1.37.20
• 1.37.21
• 1.37.22
• 1.37.23
• 1.37.24
• 1.37.25
• 1.37.26
• 1.37.27
• 1.37.28
• 1.37.29
• 1.37.30
• 1.37.31
• 1.37.32

License

• open-source

Website

• Product: https://github.com/ZoneMinder/zoneminder/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion