CVE-2022-29806: 
NixOS vulnerability analysis and mitigation

CVE-2022-29806 affects ZoneMinder versions before 1.36.13, allowing remote code execution through an invalid language setting. The vulnerability was discovered in early 2022 and officially disclosed on April 26, 2022. The issue stems from a path traversal vulnerability in the debug log file functionality and default language option, which could allow attackers to write and execute arbitrary code (Krastanoel Blog).

The vulnerability has a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue involves two main components: the ZM_LOG_DEBUG_FILE validation in includes/logger.php which allows creation of files with any extension on any path, and the ZM_LANG_DEFAULT validation in includes/lang.php that suffers from a path traversal vulnerability. These vulnerabilities can be chained together to achieve remote code execution (NVD, Krastanoel Blog).

The vulnerability allows attackers to achieve remote code execution on affected systems. An attacker can write arbitrary files to the system and execute them through the language settings functionality, potentially leading to complete system compromise (NVD).

Public exploit code is available, and the vulnerability has been demonstrated to be exploitable. The attack requires no special privileges or user interaction, making it highly exploitable. A detailed proof of concept has been published showing how to chain the debug log file creation with the language setting manipulation to achieve code execution (Krastanoel Blog).

The vulnerability was fixed in ZoneMinder version 1.36.13. The fix includes validation of ZM_LANG_DEFAULT option to prevent path traversal and improvements to the handling of language files. Users should upgrade to version 1.36.13 or later to mitigate this vulnerability (ZoneMinder Forum).