blakeblackshear frigate up to 0.13.0-beta2 Endpoint cross-site request forgery

Summaryinfo

A vulnerability marked as problematic has been reported in blakeblackshear frigate up to 0.13.0-beta2. The impacted element is an unknown function of the component Endpoint. The manipulation leads to cross-site request forgery. This vulnerability is documented as CVE-2023-45670. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in blakeblackshear frigate up to 0.13.0-beta2 and classified as problematic. This issue affects an unknown code of the component Endpoint. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. Using CWE to declare the problem leads to CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. Impacted is integrity. The summary by CVE is:

Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, the `config/save` and `config/set` endpoints of Frigate do not implement any CSRF protection. This makes it possible for a request sourced from another site to update the configuration of the Frigate server (e.g. via "drive-by" attack). Exploiting this vulnerability requires the attacker to both know very specific information about a user's Frigate server and requires an authenticated user to be tricked into clicking a specially crafted link to their Frigate instance. This vulnerability could exploited by an attacker under the following circumstances: Frigate publicly exposed to the internet (even with authentication); attacker knows the address of a user's Frigate instance; attacker crafts a specialized page which links to the user's Frigate instance; attacker finds a way to get an authenticated user to visit their specialized page and click the button/link. This issue can lead to arbitrary configuration updates for the Frigate server, resulting in denial of service and possible data exfiltration. Version 0.13.0 Beta 3 contains a patch.

The weakness was released 10/31/2023 as GHSA-xq49-hv88-jr6h. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2023-45670 since 10/10/2023. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 0.13.0-beta3 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• blakeblackshear

Name

• frigate

Version

• 0.13.0-beta1
• 0.13.0-beta2

Website

• Product: https://github.com/blakeblackshear/frigate/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion