Executive brief
motionEye is a web-based interface for motion-detection video surveillance software. An authenticated administrator can inject arbitrary operating system commands through unsanitized configuration parameters (like image_file_name), which are written to motion configuration files and executed when the motion service restarts. This allows complete takeover of the host system running motionEye.
Technical details
The vulnerability is an OS command injection flaw (CWE-20) in configuration parameter handling. User-supplied input in parameters such as image_file_name is written directly to motion configuration files without sanitization. An authenticated attacker with admin privileges can inject shell metacharacters and commands into these parameters. When the motion daemon restarts, it executes the injected commands with the privileges of the motion process, achieving arbitrary code execution. The attack requires authentication and admin access, and code execution occurs only upon motion service restart. Versions up to 0.43.1b4 are affected; the advisory was withdrawn as a duplicate of GHSA-j945-qm58-4gjx.
Affected products
- motionEye motionEye 0.43.1b4 and earlier
Timeline
- 2025-10-03: disclosed
- 2025-11-03: other: Advisory withdrawn as duplicate of GHSA-j945-qm58-4gjx