PT-2023-29639 · Frigate · Frigate
Jorgectf
+1
·
Published
2023-10-30
·
Updated
2023-12-13
·
CVE-2023-45670
CVSS v3.1
7.5
High
| Vector | AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Frigate versions prior to 0.13.0 Beta 3
Description
Frigate is an open source network video recorder. The
config/save and config/set endpoints of Frigate do not implement any CSRF protection, making it possible for a request sourced from another site to update the configuration of the Frigate server. Exploiting this issue requires the attacker to know specific information about a user's Frigate server and to trick an authenticated user into clicking a specially crafted link to their Frigate instance. This can lead to arbitrary configuration updates for the Frigate server, resulting in denial of service and possible data exfiltration.Recommendations
For Frigate versions prior to 0.13.0 Beta 3, update to version 0.13.0 Beta 3 to resolve the issue. As a temporary workaround, consider restricting access to the
config/save and config/set endpoints to minimize the risk of exploitation. Avoid exposing the Frigate server to the internet, even with authentication, and ensure that only trusted users have access to the server.Exploit
Fix
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Frigate