CVE-2022-25568
📋 TL;DR
MotionEye v0.42.1 and below contains an information disclosure vulnerability where attackers can access sensitive configuration data via unauthenticated GET requests to /config/list. This affects systems where regular user passwords are not configured, allowing unauthorized access to potentially sensitive system information.
💻 Affected Systems
- MotionEye
📦 What is this software?
Motioneye by Motioneye Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain full system configuration including credentials, API keys, network settings, and camera configurations, leading to complete system compromise and privacy violations.
Likely Case
Unauthorized users access sensitive configuration data including network settings, camera configurations, and potentially credentials stored in configuration files.
If Mitigated
With proper authentication configured, the vulnerability cannot be exploited as it requires unconfigured regular user passwords.
🎯 Exploit Status
Simple HTTP GET request to vulnerable endpoint with no authentication required when regular user password is unconfigured.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.42.2 and above
Vendor Advisory: https://github.com/ccrisan/motioneye/issues/2292
Restart Required: Yes
Instructions:
1. Update MotionEye to version 0.42.2 or later. 2. Restart the MotionEye service. 3. Verify the fix by checking that /config/list endpoint now requires authentication.
🔧 Temporary Workarounds
Configure Regular User Password
allSet a password for regular users to prevent unauthenticated access to the vulnerable endpoint.
Edit motioneye.conf and set regular_user_password parameter
Web Server Access Control
linuxConfigure web server (nginx/apache) to block access to /config/list endpoint.
Add location block for /config/list in web server configuration
🧯 If You Can't Patch
- Configure strong authentication for all MotionEye users immediately
- Implement network segmentation to restrict access to MotionEye web interface
🔍 How to Verify
Check if Vulnerable:
Attempt to access http://[motioneye-ip]:[port]/config/list without authentication. If configuration data is returned, system is vulnerable.Check Version:
Check MotionEye web interface settings page or run: grep version /etc/motioneye/motioneye.confVerify Fix Applied:
After patching, attempt the same request. Should receive authentication prompt or error instead of configuration data.📡 Detection & Monitoring
Log Indicators:
- HTTP GET requests to /config/list endpoint from unauthorized IPs
- Access logs showing successful 200 responses to /config/list without authentication
Network Indicators:
- Unusual traffic patterns to /config/list endpoint
- HTTP GET requests to /config/list from external IPs
SIEM Query:
source="motioneye.log" AND "GET /config/list" AND response=200