PT-2023-20438 · Unknown+2 · Zoneminder+2
Published
2023-02-25
·
Updated
2023-11-30
·
CVE-2023-26036
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
ZoneMinder versions prior to 1.36.33
ZoneMinder versions prior to 1.37.33
Description
The issue is a Local File Inclusion (Untrusted Search Path) vulnerability via /web/index.php. By controlling
$view, any local file ending in .php can be executed. This is supposed to be mitigated by calling detaintPath, however detaintPath does not properly sandbox the path. This can be exploited by constructing paths like "..././", which get replaced by "../".Recommendations
For versions prior to 1.36.33, update to version 1.36.33 or later.
For versions prior to 1.37.33, update to version 1.37.33 or later.
As a temporary workaround, consider restricting access to the
/web/index.php endpoint until a patch is available.
Avoid using the $view variable in the affected API endpoint until the issue is resolved.Exploit
Fix
Untrusted Search Path
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Debian
Zoneminder