cve/2021/CVE-2021-44255.md

CVE-2021-44255

Description

Authenticated remote code execution in MotionEye <= 0.42.1 and MotioneEyeOS <= 20200606 allows a remote attacker to upload a configuration backup file containing a malicious python pickle file which will execute arbitrary code on the server.

POC

Reference

• https://www.pizzapower.me/2021/10/09/self-hosted-security-part-1-motioneye/

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/NaInSec/CVE-PoC-in-GitHub
• https://github.com/SYRTI/POC_to_review
• https://github.com/WhooAmii/POC_to_review
• https://github.com/nomi-sec/PoC-in-GitHub
• https://github.com/pizza-power/motioneye-authenticated-RCE
• https://github.com/trhacknon/Pocingit
• https://github.com/zecool/cve