Remote Code Execution (RCE) Affecting pi_video_recording package, versions *
Snyk CVSS
Attack Complexity
High
User Interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Threat Intelligence
Exploit Maturity
Proof of concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-PIVIDEORECORDING-174696
- published 14 May 2019
- disclosed 25 Jan 2019
- credit Customer Security and Trust Team of Microsoft Corp.
How to fix?
There is no fixed version for pi_video_recording.
Overview
pi_video_recording is a Raspbian with raspivid module for NPM.
Affected versions of this package are vulnerable to Remote Code Execution (RCE). Due to insufficient input validation, the server used by raspberry-pi video recording & live executes arbitrary code through the /api/record/start endpoint.
POC
curl -POST -H "Content-Type: application/json" -d '{"filename": " || touch /tmp/worked;"}
Sending the above HTTP request to a http://localhost:5000/api/record/start creates a new file within the /tmp/ directory of the target server.