Executive brief
motionEye, a popular web interface for managing video surveillance cameras, is vulnerable to a multi-stage attack that allows remote code execution. An attacker can read sensitive system files, hijack administrative sessions, and ultimately take full control of the server. This could lead to the unauthorized viewing of camera feeds, theft of data, or the use of the server as a foothold for further network attacks.
Technical details
The vulnerability is a chain of four distinct issues: 1) Local File Inclusion (LFI) in the picture download endpoint due to improper path sanitization, allowing absolute path traversal. 2) A 'pass-the-hash' flaw where the application accepts request signatures generated with password hashes instead of plaintext. 3) An unsafe configuration restore function that extracts unsanitized tarballs into the configuration directory. 4) Missing authentication on the action execution handler. An attacker can use LFI to steal the admin password hash, authenticate as admin, upload a malicious executable via the restore function, and trigger its execution via the unauthenticated action endpoint. This results in full Remote Code Execution (RCE). The issue is patched in version 0.44.0.
Affected products
- motioneye-project motionEye < 0.44.0
Timeline
- 2026-06-20: disclosed
- 2026-06-23: advisory
- 2026-06-23: patched