PT-2022-6497 · Unknown+4 · Zoneminder+4

Krastanoel · CVE-2022-29806 · Published 2022-02-08 · Updated 2023-11-30

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.36.13

Description The issue is related to incorrect restriction of a directory path with limited access in ZoneMinder, a video surveillance software. This can be exploited by a remote attacker to execute arbitrary code by sending a specially crafted file to the server. The vulnerability can be exploited via an invalid language, which contributes to its exploitability.

Recommendations For versions prior to 1.36.13, update to version 1.36.13 or later to resolve the issue. As a temporary workaround, consider restricting access to the language settings to minimize the risk of exploitation.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

ALT-PU-2022-2575

ALT-PU-2022-2771

ALT-PU-2023-7284

BDU:2023-01774

CVE-2022-29806

USN-5889-1

Affected Products

Alt Linux

Debian

Linuxmint

Ubuntu

Zoneminder

References · 39

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/zoneminder_snapshots.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/zoneminder_lang_exec.rb · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29806.json · Exploit
• 🔥 https://github.com/rvizx/CVE-2023-26035 · Exploit
• 🔥 https://github.com/heapbytes/CVE-2023-26035 · Exploit
• 🔥 https://github.com/Yuma-Tsushima07/CVE-2023-26035 · Exploit
• 🔥 http://packetstormsecurity.com/files/166980/ZoneMinder-Language-Settings-Remote-Code-Execution.html · Exploit
• 🔥 https://krastanoel.com/cve/2022-29806 · Exploit
• https://github.com/ZoneMinder/zoneminder/commit/9fee64b62fbdff5bf5ece1d617f1f53c7b1967cb · Patch
• https://ubuntu.com/security/CVE-2019-6990 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-29806 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-29806 · Security Note
• https://ubuntu.com/security/CVE-2019-7326 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-29806 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-7330 · Vendor Advisory