Incorrect Access Control in ZLMediaKit Leading to Remote Code Execution

Executive Summary

This vulnerability is an Incorrect Access Control flaw in ZLMediaKit's HTTP API module. It allows remote attackers to execute arbitrary code on the system by exploiting unauthenticated access to the setServerConfig API endpoint. The attacker can overwrite the ffmpeg.snap configuration parameter with malicious shell commands, which are then executed through the getSnap API endpoint with the privileges of the ZLMediaKit process.

Useful 0 Not Useful 0

Detection Guidance

Check if unauthenticated access to the setServerConfig API endpoint is possible by sending a request to the HTTP API module. Look for unexpected changes in the ffmpeg.snap configuration parameter. Monitor logs for suspicious commands executed via the getSnap API endpoint.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to Remote Code Execution (RCE), allowing attackers to run arbitrary commands on your system. This could result in unauthorized access, data theft, system compromise, or disruption of services. The impact depends on the privileges of the ZLMediaKit process and the system's configuration.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated remote attackers to execute arbitrary shell commands with the privileges of the ZLMediaKit process. This could lead to unauthorized access to sensitive data, data exfiltration, or system compromise, which would violate compliance requirements under GDPR and HIPAA by failing to ensure proper access controls and data protection.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict access to the setServerConfig API endpoint to authenticated users only. Update ZLMediaKit to a patched version if available. Disable or remove the getSnap API endpoint if not required. Review and remove any unauthorized changes to ffmpeg.snap configuration.

Useful 0 Not Useful 0