CVE-2022-29806
published 2022-04-26CVE-2022-29806: ZoneMinder before 1.36.13 allows remote code execution via an invalid language. Ability to create a debug log file at an arbitrary pathname contributes to…
PriorityP179critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
66.32%
99.2th percentile
ZoneMinder before 1.36.13 allows remote code execution via an invalid language. Ability to create a debug log file at an arbitrary pathname contributes to exploitability.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | zoneminder | < zoneminder 1.36.13+dfsg1-1 (bookworm) | zoneminder 1.36.13+dfsg1-1 (bookworm) |
| zoneminder | zoneminder | < 1.36.13 | 1.36.13 |
| zoneminder | zoneminder | >= 0 < 1.36.13+dfsg1-1 | 1.36.13+dfsg1-1 |
| zoneminder | zoneminder | >= 0 < 1.36.13+dfsg1-1 | 1.36.13+dfsg1-1 |
| zoneminder | zoneminder | >= 0 < 1.36.13+dfsg1-1 | 1.36.13+dfsg1-1 |
| zoneminder | zoneminder | >= 0 < 1.29.0+dfsg-1ubuntu2+esm1 | 1.29.0+dfsg-1ubuntu2+esm1 |
| zoneminder | zoneminder | >= 0 < 1.32.3-2ubuntu2+esm1 | 1.32.3-2ubuntu2+esm1 |
| zoneminder | zoneminder | >= 0 < 1.36.12+dfsg1-1ubuntu0.1~esm1 | 1.36.12+dfsg1-1ubuntu0.1~esm1 |
Detection & IOCsextracted from sources · hover to see the quote
urlhttps://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/zoneminder_lang_exec.rb↗
- →Monitor ZoneMinder language settings changes to invalid or unexpected language values, which may indicate exploitation of the path traversal vector. ↗
- →Alert on creation of debug log files at arbitrary or unexpected pathnames outside of normal ZoneMinder log directories, as this is a prerequisite step in the exploit chain. ↗
- →Detect exploitation attempts using the Metasploit module 'zoneminder_lang_exec' targeting ZoneMinder versions before 1.36.13 and before 1.37.11 via path traversal in language settings chained with arbitrary file write. ↗
- ·The vulnerability requires two conditions to be met: a path traversal via invalid language settings AND the ability to write a debug log file to an arbitrary path. Both must be present for successful RCE. ↗
- ·Debian bullseye remains unpatched/open as of the tracked advisory; only bookworm, forky, sid, and trixie have resolved the issue with 1.36.13+dfsg1-1. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8LOW
vendor_ubuntu6.1MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
zoneminder vulnerabilities
osv·2023-02-27·CVSS 6.1
CVE-2019-6777 [MEDIUM] zoneminder vulnerabilities
zoneminder vulnerabilities
It was discovered that ZoneMinder was not properly sanitizing URL
parameters for certain views. An attacker could possibly use this issue to
perform a cross-site scripting (XSS) attack. This issue was only fixed in
Ubuntu 16.04 ESM. (CVE-2019-6777)
It was discovered that ZoneMinder was not properly sanitizing stored user
input later printed to the user in certain views. An attacker could
possibly use this issue to perform a cross-site scripting (XSS) attack.
This issue was only fixed in Ubuntu 16.04 ESM. (CVE-2019-6990,
CVE-2019-6992)
It was discovered that ZoneMinder was not properly limiting data size and
not properly performing bound checks when processing username and password
data, which could lead to a stack buffer overflow. An attacker could
possibly us
GHSA
GHSA-xr7v-8xc4-62vc: ZoneMinder before 1
ghsa_unreviewed·2022-04-27
CVE-2022-29806 [CRITICAL] CWE-22 GHSA-xr7v-8xc4-62vc: ZoneMinder before 1
ZoneMinder before 1.36.13 allows remote code execution via an invalid language.
OSV
CVE-2022-29806: ZoneMinder before 1
osv·2022-04-26·CVSS 9.8
CVE-2022-29806 [CRITICAL] CVE-2022-29806: ZoneMinder before 1
ZoneMinder before 1.36.13 allows remote code execution via an invalid language. Ability to create a debug log file at an arbitrary pathname contributes to exploitability.
Ubuntu
ZoneMinder vulnerabilities
vendor_ubuntu·2023-02-27·CVSS 6.1
CVE-2019-7332 [MEDIUM] ZoneMinder vulnerabilities
Title: ZoneMinder vulnerabilities
Summary: Several security issues were fixed in ZoneMinder.
It was discovered that ZoneMinder was not properly sanitizing URL
parameters for certain views. An attacker could possibly use this issue to
perform a cross-site scripting (XSS) attack. This issue was only fixed in
Ubuntu 16.04 ESM. (CVE-2019-6777)
It was discovered that ZoneMinder was not properly sanitizing stored user
input later printed to the user in certain views. An attacker could
possibly use this issue to perform a cross-site scripting (XSS) attack.
This issue was only fixed in Ubuntu 16.04 ESM. (CVE-2019-6990,
CVE-2019-6992)
It was discovered that ZoneMinder was not properly limiting data size and
not properly performing bound checks when processing username and password
data, which c
Debian
CVE-2022-29806: zoneminder - ZoneMinder before 1.36.13 allows remote code execution via an invalid language. ...
vendor_debian·2022·CVSS 9.8
CVE-2022-29806 [CRITICAL] CVE-2022-29806: zoneminder - ZoneMinder before 1.36.13 allows remote code execution via an invalid language. ...
ZoneMinder before 1.36.13 allows remote code execution via an invalid language. Ability to create a debug log file at an arbitrary pathname contributes to exploitability.
Scope: local
bookworm: resolved (fixed in 1.36.13+dfsg1-1)
bullseye: open
forky: resolved (fixed in 1.36.13+dfsg1-1)
sid: resolved (fixed in 1.36.13+dfsg1-1)
trixie: resolved (fixed in 1.36.13+dfsg1-1)
No detection rules found.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/166980/ZoneMinder-Language-Settings-Remote-Code-Execution.htmlhttps://forums.zoneminder.com/viewtopic.php?t=31638https://github.com/ZoneMinder/zoneminder/commit/9fee64b62fbdff5bf5ece1d617f1f53c7b1967cbhttps://github.com/ZoneMinder/zoneminder/releases/tag/1.36.13https://krastanoel.com/cve/2022-29806http://packetstormsecurity.com/files/166980/ZoneMinder-Language-Settings-Remote-Code-Execution.htmlhttps://forums.zoneminder.com/viewtopic.php?t=31638https://github.com/ZoneMinder/zoneminder/commit/9fee64b62fbdff5bf5ece1d617f1f53c7b1967cbhttps://github.com/ZoneMinder/zoneminder/releases/tag/1.36.13https://krastanoel.com/cve/2022-29806
2022-04-26
Published