GHSA-qxvg-h7q2-hcxh: motionEye: LFI → pass‑the‑hash admin → unsafe restore → unauth action exec (RCE)

Should you act?

• Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with pip-audit (or: pip show <package>).
• No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories. npm audit, pip-audit and Dependabot do read GitHub advisories.

Affected packages

Details

Summary A multi‑stage chain in motionEye leads to remote code execution. The chain combines:

1. Arbitrary file read (LFI) via the picture download endpoint for local motion cameras using absolute paths. 2. Pass‑the‑hash admin auth due to accepting request signatures computed with password hashes. 3. Unsafe config restore that extracts attacker‑controlled tarballs into CONFPATH. 4. Unauthenticated action execution via /action/ / .

If the normal user password is unset, the chain becomes unauthenticated RCE. If a normal password exists, a normal user can still achieve admin escalation and RCE.

---

Affected Code (motionEye repo)

1) LFI (absolute path) — picture/ /download Files: - motioneye/motioneye/handlers/picture.py → download() (local motion camera branch) - motioneye/motioneye/mediafiles.py → getmediacontent()

Issue: getmediacontent() only blocks .. and then joins targetdir with path. Absolute paths (e.g. /etc/hosts) bypass the join and are read directly.

2) Pass‑the‑hash admin auth File: motioneye/motioneye/handlers/base.py → getcurrentuser()

CVSS: 9.8 (v3.1) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Sources and references

1. GitHub Advisory GHSA-qxvg-h7q2-hcxh github.com
2. github.com github.com

Critical PyPI advisories · Today’s Security Digest