mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-07-27 05:16:46 -04:00
65bb4ad6dc
The Device field from the Monitors table was interpolated directly into shell commands (qx(), backticks, exec()) without sanitization, allowing authenticated users with monitor-edit permissions to execute arbitrary commands as www-data via the Device Path field. Defense in depth: - Input validation: reject Device values not matching /^\/dev\/[\w\/.\-]+$/ at save time in both web UI and REST API - Output sanitization: use escapeshellarg() in PHP and quote validated values in Perl at every shell execution point Affected locations: - scripts/ZoneMinder/lib/ZoneMinder/Monitor.pm (control, zmcControl) - scripts/zmpkg.pl.in (system startup) - web/includes/Monitor.php (zmcControl) - web/includes/functions.php (zmcStatus, zmcCheck, validDevicePath) - web/includes/actions/monitor.php (save action) - web/api/app/Model/Monitor.php (daemonControl, validation rules) - web/api/app/Controller/MonitorsController.php (daemonStatus) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
ZoneMinder version 0.01 ======================= The README is used to introduce the module and provide instructions on how to install the module, any machine dependencies it may have (for example C compilers and installed libraries) and any other information that should be provided before the module is installed. A README file is required for CPAN modules since CPAN extracts the README file from a module distribution so that people browsing the archive can use it get an idea of the modules uses. It is usually a good idea to provide version information here so that people can decide whether fixes for the module are worth downloading. INSTALLATION To install this module type the following: perl Makefile.PL make make test make install DEPENDENCIES This module requires these other modules and libraries: blah blah blah COPYRIGHT AND LICENCE Put the correct copyright and licence information here. Copyright (C) 2005 by Philip Coombes This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself, either Perl version 5.8.3 or, at your option, any later version of Perl 5 you may have available.