CVE-2021-44255
📋 TL;DR
This vulnerability allows authenticated attackers to execute arbitrary code on MotionEye and MotionEyeOS servers by uploading malicious Python pickle files disguised as configuration backups. It affects users running MotionEye <= 0.42.1 or MotionEyeOS <= 20200606 with authenticated access to the web interface.
💻 Affected Systems
- MotionEye
- MotionEyeOS
📦 What is this software?
Motioneye by Motioneye Project
Motioneyeos by Motioneyeos Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attacker to install persistent backdoors, steal data, pivot to other systems, or use the server for cryptocurrency mining or botnet activities.
Likely Case
Attacker gains shell access to the server, potentially compromising the entire MotionEye/MotionEyeOS installation and any connected cameras or storage systems.
If Mitigated
Attack fails due to proper authentication controls, network segmentation, or the system being patched to the latest version.
🎯 Exploit Status
Exploitation requires authentication but is straightforward once credentials are obtained. Public proof-of-concept code exists demonstrating the pickle deserialization attack.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: MotionEye > 0.42.1, MotionEyeOS > 20200606
Vendor Advisory: https://github.com/ccrisan/motioneyeos/issues/2843
Restart Required: Yes
Instructions:
1. Update MotionEye to version > 0.42.1 via pip: 'pip install --upgrade motioneye'. 2. For MotionEyeOS, flash the latest version > 20200606. 3. Restart the MotionEye service or reboot the system.
🔧 Temporary Workarounds
Disable configuration backup upload
allRemove or disable the configuration backup upload functionality in the web interface if not needed.
# Edit motioneye.conf and set 'upload_enabled' to false
# Or modify web interface permissions
Network segmentation
linuxPlace MotionEye/MotionEyeOS instances on isolated VLANs with strict firewall rules limiting access.
# Example iptables rule: iptables -A INPUT -p tcp --dport 8765 -s trusted_ip -j ACCEPT
# iptables -A INPUT -p tcp --dport 8765 -j DROP
🧯 If You Can't Patch
- Implement strong authentication with complex passwords and consider multi-factor authentication if supported.
- Restrict network access to MotionEye web interface using firewall rules to only allow trusted IP addresses.
🔍 How to Verify
Check if Vulnerable:
Check the MotionEye version in the web interface under Settings > About, or run 'motioneye --version' on the command line. For MotionEyeOS, check the version in the web interface.Check Version:
motioneye --version 2>/dev/null || grep version /etc/motioneye.conf 2>/dev/null || echo 'Check web interface Settings > About'Verify Fix Applied:
Confirm version is > 0.42.1 for MotionEye or > 20200606 for MotionEyeOS. Test that configuration backup upload functionality properly validates file types.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to configuration backup endpoint
- Python pickle deserialization errors in logs
- Unexpected Python process execution
Network Indicators:
- POST requests to /config/backup/upload with unusual payloads
- Outbound connections from MotionEye server to unknown IPs
SIEM Query:
source="motioneye.log" AND ("upload" OR "backup") AND ("pickle" OR "deserialization" OR "malicious")