A critical vulnerability in Shinobi allows unauthenticated remote attackers to execute arbitrary SQL commands, potentially leading to a full compromise of surveillance data and system configurations.

This vulnerability is caused by the use of hardcoded credentials within the child node service, which fails to perform authentication. An attacker can use this static key during a WebSocket handshake to interact with the onWebSocketDataFromChildNode handler and inject malicious SQL queries.

The ability for an unauthenticated attacker to execute arbitrary database queries poses a severe risk to organizational security. Successful exploitation could result in the total compromise of user credentials, unauthorized access to live video feeds, and the modification of camera configurations, leading to significant privacy violations and operational disruption. Given the CVSS score of 9.8, this vulnerability must be treated as a critical priority.

Immediate Action: Update the Shinobi installation to the latest version, which includes commit 5a76c74f or higher, to remove the hardcoded key.

Proactive Monitoring: Review access logs for the child node port, specifically monitoring for unusual WebSocket handshake patterns or queries originating from unauthorized IP addresses.

Compensating Controls: Implement strict network segmentation to restrict access to the child node port to only trusted internal management servers. Use a firewall or Web Application Firewall (WAF) to filter traffic and block unexpected WebSocket requests.

Public Exploit Available: Unknown

This vulnerability represents a catastrophic failure of authentication controls, allowing complete control over the application database. Organizations must prioritize patching this flaw immediately to prevent potential data exfiltration and unauthorized system manipulation. If patching is not immediately feasible, ensure that the affected management ports are not exposed to the public internet under any circumstances.