CVE-2022-29806 : ZoneMinder before 1.36.13 allows remote code execution via an invalid language.

ZoneMinder before 1.36.13 allows remote code execution via an invalid language. Ability to create a debug log file at an arbitrary pathname contributes to exploitability.

Published 2022-04-26 04:15:42

Updated 2022-05-06 13:07:40

Source MITRE

View at NVD, CVE.org

Vulnerability category: Directory traversalExecute code

Products affected by CVE-2022-29806

Zoneminder » Zoneminder
Versions before (<) 1.36.13
cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-29806

EPSS FAQ

87.24%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2022-29806

ZoneMinder Language Settings Remote Code Execution

Disclosure Date: 2022-04-27

First seen: 2022-12-23

exploit/unix/webapp/zoneminder_lang_exec

This module exploits arbitrary file write in debug log file option chained with a path traversal in language settings that leads to a remote code execution in ZoneMinder surveillance software versions before 1.36.13 and before 1.37.11 Authors: - kr

More information

CVSS scores for CVE-2022-29806

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-29806

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-29806

http://packetstormsecurity.com/files/166980/ZoneMinder-Language-Settings-Remote-Code-Execution.html

ZoneMinder Language Settings Remote Code Execution ≈ Packet Storm
Exploit;Third Party Advisory
https://krastanoel.com/cve/2022-29806

CVE-2022-29806 - krastanoel
Exploit;Third Party Advisory
https://github.com/ZoneMinder/zoneminder/commit/9fee64b62fbdff5bf5ece1d617f1f53c7b1967cb

detaint language file. · ZoneMinder/zoneminder@9fee64b · GitHub
Patch;Third Party Advisory
https://github.com/ZoneMinder/zoneminder/releases/tag/1.36.13

Release The Memory Remains 1.36.13 · ZoneMinder/zoneminder · GitHub
Release Notes;Third Party Advisory
https://forums.zoneminder.com/viewtopic.php?t=31638

Released 1.36.13 The Memory Remains - ZoneMinder Forums
Release Notes;Vendor Advisory

Jump to