Executive brief
motionEye is a popular web interface for managing surveillance cameras. A security flaw allows unauthenticated attackers to steal administrative credentials and take full control of the system if the secondary 'normal' user password is left at its default empty setting. This can lead to unauthorized viewing of camera feeds, theft of sensitive files from the device, and the ability to execute malicious commands on the underlying operating system.
Technical details
The vulnerability is a chain of three issues in motionEye versions prior to 0.44.0. First, the application grants 'normal' user privileges to unauthenticated requests if the `@normal_password` is empty (the default). Second, multiple handlers including `MoviePlaybackHandler` and `MovieDownloadHandler` are vulnerable to path traversal because they override Tornado's `get_absolute_path` and `validate_absolute_path` safety checks, allowing an attacker to read arbitrary files like `motion.conf`. Third, the configuration file stores the admin password as a SHA-1 hash which the authentication logic in `base.py` accepts directly as a valid signing key for API requests. An attacker can exploit this to gain full administrative access and subsequently achieve Remote Code Execution (RCE) by configuring malicious shell commands in motion event hooks.
Affected products
- motioneye-project motionEye < 0.44.0
Timeline
- 2026-06-20: advisory: GitHub advisory published
- 2026-06-23: disclosed