README.md

CVE-2025-60787 Detection: motionEye RCE via Config Injection

Unauthenticated Remote Code Execution in motionEye <= 0.43.1b4

Vulnerability Overview

This repository contains detection rules for CVE-2025-60787, an unauthenticated RCE vulnerability in motionEye.

Exploitation Method

Payload injected into:

• Settings -> Still Images -> Image File Name

Example PoC payload:

$(touch /tmp/test).%Y-%m-%d-%H-%M-%S

When motion restarts, the shell command executes and creates /tmp/test.

Detection Coverage

YARA Detection

Scan motionEye configuration directory:

yara -r rules/yara/motioneye_rce_cve_2025_60787.yar /etc/motioneye/

KQL Detection (Microsoft Sentinel / Defender)

Queries included:

• 01_web_request_js_bypass_and_shell_payload.kql
• 02_process_execution_shell_spawned_by_motion.kql
• 03_file_creation_tmp_by_motion_process.kql
• 04_docker_exec_and_syslog_motioneye.kql
• 05_threat_hunting_motioneye_config_file_changes.kql

Testing

Start vulnerable container:

docker run -d --name motioneye -p 9999:8765 ghcr.io/motioneye-project/motioneye:edge

Verify version:

docker logs motioneye | grep "motionEye server"

Access Web UI:

http://127.0.0.1:9999

Login:

admin (blank password)

Repository Structure

cve-2025-60787-detection/
├── README.md
├── LICENSE
├── .gitignore
├── rules/
│   ├── yara/
│   │   └── motioneye_rce_cve_2025_60787.yar
│   └── kql/
│       ├── 01_web_request_js_bypass_and_shell_payload.kql
│       ├── 02_process_execution_shell_spawned_by_motion.kql
│       ├── 03_file_creation_tmp_by_motion_process.kql
│       ├── 04_docker_exec_and_syslog_motioneye.kql
│       └── 05_threat_hunting_motioneye_config_file_changes.kql
└── docs/
    └── iocs.md

References

• Exploit-DB ID: 52481
• CVE-2025-60787
• motionEye Project

Credits

License

MIT License - See LICENSE file.