CVE-2022-25568

Vulnerability

MotionEye versions 0.42.1 and earlier expose a configuration information disclosure vulnerability through the /config/list endpoint. An unauthenticated GET request to this path returns the full application configuration, including sensitive data such as passwords, API keys, email credentials, and internal network details. The vulnerable code path is reachable when no regular user password has been configured, even if an admin password is set [1][4].

Exploitation

An attacker can exploit this vulnerability by sending a simple GET request to /config/list without any authentication. The attack requires no special privileges or user interaction. The only precondition is that the MotionEye instance does not have a regular user password configured; setting only an admin password does not prevent the disclosure [1][4].

Impact

Successful exploitation results in unauthorized disclosure of the full MotionEye configuration file. This typically exposes plaintext passwords, SMTP credentials, cloud storage tokens (e.g., Gmail, GDrive, FTP, SFTP), API keys, and internal IP addresses. The attacker gains sensitive information that can be used for further compromise, credential stuffing, or network reconnaissance. The impact is considered high because it bypasses intended authentication controls [4].

Mitigation

As of the available references, no official patched version has been released. The project maintainer closed the initial issue without a fix, and while a pull request was submitted, it has not been merged or tested [4]. Users are advised to set a regular user password to block access to the /config/list endpoint. Alternatively, restricting network access to the MotionEye web interface or placing it behind a reverse proxy with authentication can reduce exposure. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog [2][3].