Vulnerability record · CVE-2022-37109 · published 14 November 2022
CVE-2022-37109: camp Raspberry Pi camera server authentication bypass via exposed password file
Camp Project · Camp
patrickfuller camp (up to commit bbd53a256ed70e79bd8758080936afbf6d738767) has incorrect access control: password.txt sits in the root directory served by StaticFileHandler, and the Tornado rule intended to return 403 for that file can be bypassed. Because the password hash doubles as the cookie secret, an attacker who reads the file can forge a valid authentication cookie without cracking the hash.
Description
patrickfuller camp up to and including commit bbd53a256ed70e79bd8758080936afbf6d738767 is vulnerable to Incorrect Access Control. Access to the password.txt file is not properly restricted as it is in the root directory served by StaticFileHandler and the Tornado rule to throw a 403 error when password.txt is accessed can be bypassed. Furthermore, it is not necessary to crack the password hash to authenticate with the application because the password hash is also used as the cookie secret, so an attacker can generate his own authentication cookie.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with no authentication or interaction required, a bypassable access control, and public exploit code make this a critical exposure for any internet-reachable camp instance.
What it is
patrickfuller camp (up to commit bbd53a256ed70e79bd8758080936afbf6d738767) has incorrect access control: password.txt sits in the root directory served by StaticFileHandler, and the Tornado rule intended to return 403 for that file can be bypassed. Because the password hash doubles as the cookie secret, an attacker who reads the file can forge a valid authentication cookie without cracking the hash.
Impact
An unauthenticated attacker gains full application access, including the ability to generate their own authentication cookie and act as a legitimate user. The CVSS vector rates confidentiality, integrity and availability impact as high.
Attack surface
Reachable over the network via HTTP requests to the static file handler; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The flaw is in the web application's file-serving and cookie-signing logic.
Exploitation
Not listed in CISA KEV, but EPSS 30-day probability is 0.49482 (98.8th percentile) and public exploit code and write-ups are referenced, indicating active interest and available tooling.
What to do
- Apply the upstream patch commit bf6af5c2e5cf713e4050c11c52dd4c55e89880b1 or upgrade to a build that includes it.
- Remove password.txt from any web-served root directory and confirm the static handler cannot reach it.
- Use a separate, randomly generated secret for cookie signing instead of the password hash.
- Restrict network exposure of the camp server to trusted networks or place it behind an authenticating reverse proxy.
- Rotate the password and cookie secret after remediation in case the hash was exposed.
Detection
- Monitor web logs for requests to /password.txt or similar static paths returning 200 instead of 403.
- Alert on authentication cookies that validate without a prior successful login, or on anomalous cookie values.
- Watch for access to the camp service from unexpected source IPs or user agents.
- Review file system and web root contents for credential files exposed by the static handler.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2022-37109 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-37109), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
