blakeblackshear frigate up to 0.13.0-beta2 /config load_config_with_no_duplicates deserialization

Summaryinfo

A vulnerability described as problematic has been identified in blakeblackshear frigate up to 0.13.0-beta2. Impacted is the function load_config_with_no_duplicates of the file /config. Executing a manipulation can lead to deserialization. This vulnerability appears as CVE-2023-45672. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic was found in blakeblackshear frigate up to 0.13.0-beta2. This vulnerability affects the function load_config_with_no_duplicates of the file /config. The manipulation with an unknown input leads to a deserialization vulnerability. The CWE definition for the vulnerability is CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, an unsafe deserialization vulnerability was identified in the endpoints used to save configurations for Frigate. This can lead to unauthenticated remote code execution. This can be performed through the UI at `/config` or through a direct call to `/api/config/save`. Exploiting this vulnerability requires the attacker to both know very specific information about a user's Frigate server and requires an authenticated user to be tricked into clicking a specially crafted link to their Frigate instance. This vulnerability could exploited by an attacker under the following circumstances: Frigate publicly exposed to the internet (even with authentication); attacker knows the address of a user's Frigate instance; attacker crafts a specialized page which links to the user's Frigate instance; attacker finds a way to get an authenticated user to visit their specialized page and click the button/link. Input is initially accepted through `http.py`. The user-provided input is then parsed and loaded by `load_config_with_no_duplicates`. However, `load_config_with_no_duplicates` does not sanitize this input by merit of using `yaml.loader.Loader` which can instantiate custom constructors. A provided payload will be executed directly at `frigate/util/builtin.py:110`. This issue may lead to pre-authenticated Remote Code Execution. Version 0.13.0 Beta 3 contains a patch.

The weakness was presented 10/31/2023 as GHSA-qp3h-4q62-p428. The advisory is available at github.com. This vulnerability was named CVE-2023-45672 since 10/10/2023. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit.

Upgrading to version 0.13.0-beta3 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• blakeblackshear

Name

• frigate

Version

• 0.13.0-beta1
• 0.13.0-beta2

Website

• Product: https://github.com/blakeblackshear/frigate/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion