Cross-Site Scripting Vulnerability in ZoneMinder: A Threat to CCTV Software
Summary
DEBIAN-CVE-2024-43359: ZoneMinder is a free, open source closed-circuit television software application. Affects zoneminder versions < 1.36.35+dfsg1-1. Fixed in 1.36.35+dfsg1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ZoneMinder is a free, open-source closed-circuit television (CCTV) software application that allows users to monitor and manage video feeds from security cameras. It provides features such as motion detection, recording, and remote access to camera feeds. However, it has been identified to have a cross-site scripting (XSS) vulnerability that can potentially expose users to security risks.
Vulnerability Detail
The vulnerability in ZoneMinder arises from improper handling of user input in the montagereview feature, specifically through the displayinterval, speed, and scale parameters. This flaw allows attackers to inject malicious scripts into the web application, which can be executed in the context of the user's browser. If exploited, this could lead to unauthorized access to sensitive information, session hijacking, or other malicious activities.
How To Fix
Minimum fixed version
1.36.35+dfsg1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade zoneminderTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the montagereview feature or sanitize user inputs to prevent the execution of malicious scripts until the software is updated.
Conclusion
The identified cross-site scripting vulnerability in ZoneMinder poses a significant risk to users of the software. It is crucial to update to the latest patched version to mitigate these risks and ensure the security of your CCTV monitoring system.
See every vulnerability recorded for zoneminder →
FAQ
The vulnerability is a cross-site scripting (XSS) issue that allows attackers to inject malicious scripts through specific parameters in the montagereview feature.
If you are using a version prior to 1.36.35+dfsg1-1, your installation is vulnerable to this issue.
Exploitation of this vulnerability could lead to unauthorized access to user sessions, data theft, or other malicious activities.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without requiring any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for zoneminder.
