Summary
A critical access-control flaw in ZLMediaKit's HTTP API allows unauthenticated remote users to alter the ffmpeg.snap configuration with shell commands. When the affected snapshot functionality processes that configuration, the commands may execute with the privileges of the ZLMediaKit process.
Affected context
The issue occurs in ZLMediaKit deployments that expose the HTTP API and permit unauthenticated access to the server-configuration and snapshot-related endpoints. Risk is greatest when the service is reachable by untrusted networks and the ZLMediaKit process has permissions to access sensitive files, services, or system resources.
Exploit preconditions
- Attack surface: ZLMediaKit HTTP API
- Required access: Network access to the API; authentication is not required according to the vulnerability description
- Trigger point: Processing of the snapshot configuration through the snapshot API
- Why exploitation is possible: An improperly protected configuration endpoint permits attacker-controlled command content to reach a shell-execution path
Why this happens
The vulnerability results from incorrect access control combined with unsafe handling of a configuration value that can influence command execution. The API allows an unauthenticated caller to overwrite ffmpeg.snap, and a later snapshot operation uses that value in a command-execution context without adequately restricting its contents. This behavior maps to CWE-94: Improper Control of Generation of Code, because externally controlled data is treated as executable command logic.
Potential impact
- An attacker may execute arbitrary commands on the ZLMediaKit host
- The attacker could access, modify, or delete data available to the service account
- The compromised process may be used for lateral movement or persistence
- Media streams, recordings, and service configuration could be disrupted or manipulated
- A vulnerable internet-facing deployment can be incorporated into broader attacks
General mitigation guidance
Mitigation generally focuses on protecting administrative API operations and removing command interpretation from externally controlled configuration values.
Common defensive patterns include:
- Requiring strong authentication and authorization for configuration-changing endpoints
- Applying deny-by-default network policies to administrative HTTP APIs
- Replacing shell-command construction with fixed executable paths and structured argument APIs
- Treating configuration values as data and enforcing strict allowlists and type-aware validation
- Separating snapshot configuration from arbitrary command execution capabilities
- Running ZLMediaKit with a dedicated least-privilege account and restricted filesystem access
- Limiting process, network, and host permissions through container or service isolation
- Auditing existing configuration for unexpected command content and unauthorized changes
How teams detect issues like this
Detection can combine application, source-code, and deployment controls:
- Use static analysis to identify shell execution, command-string concatenation, and externally controlled configuration values
- Review API routes for missing authentication or authorization checks, especially for configuration mutation
- Search code and tests for uses of
ffmpeg.snapor similar values in process-spawning paths - Monitor requests that modify server configuration and correlate them with subsequent snapshot operations
- Alert on unexpected child processes, unusual command interpreters, or abnormal filesystem and network activity from the ZLMediaKit process
- Enforce API gateway policies that restrict administrative methods and endpoints to trusted identities or networks
- Use automated code-review and policy tools to flag command injection and missing access-control patterns
