Описание
motionEye vulnerable to RCE in add_camera Function Due to unsafe command execution
Summary
Using a constructed (camera) device path with the config/add/add_camera motionEye web API allows an attacker with motionEye admin user credentials to execute any UNIX shell code within a non-interactive shell as executing user of the motionEye instance, motion by default.
function call stack
postadd_cameraconfig.add_camerav4l2ctl.list_resolutionsutils.call_subprocesssubprocess.run
PoC
build
reproduce
Run:
Now, run the following script to attack motionEye:
Discussion
It is obvious that call_subprocess was used to execute the incoming data, resulting in a vulnerability
Impact
RCE
Patches
The vulnerability has been patch with motionEye v0.43.1b4: https://github.com/motioneye-project/motioneye/pull/3143
Workarounds
Applying the following patch, replacing the literal single quotes in the created cmd string with a shlex.quoted input device: https://patch-diff.githubusercontent.com/raw/motioneye-project/motioneye/pull/3143.patch
References
https://github.com/motioneye-project/motioneye/issues/3142
Credit
The vulnerability was discovered by Tencent YunDing Security Lab.
Ссылки
- https://github.com/motioneye-project/motioneye/security/advisories/GHSA-g5mq-prx7-c588
- https://nvd.nist.gov/vuln/detail/CVE-2025-47782
- https://github.com/motioneye-project/motioneye/issues/3142
- https://github.com/motioneye-project/motioneye/pull/3143
- https://github.com/pypa/advisory-database/tree/main/vulns/motioneye/PYSEC-2025-39.yaml
Пакеты
motioneye
>= 0.43.1b1, < 0.43.1b4
0.43.1b4
Связанные уязвимости
motionEye is an online interface for the software motion, a video surveillance program with motion detection. In versions 0.43.1b1 through 0.43.1b3, using a constructed (camera) device path with the `add`/`add_camera` motionEye web API allows an attacker with motionEye admin user credentials to execute any command within a non-interactive shell as motionEye run user, `motion` by default. The vulnerability has been patched with motionEye v0.43.1b4. As a workaround, apply the patch manually.