Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, the config/save
and config/set
endpoints of Frigate do not implement any CSRF protection. This makes it possible for a request sourced from another site to update the configuration of the Frigate server (e.g. via drive-by attack). Exploiting this vulnerability requires the attacker to both know very specific information about a users Frigate server and requires an authenticated user to be tricked into clicking a specially crafted link to their Frigate instance. This vulnerability could exploited by an attacker under the following circumstances: Frigate publicly exposed to the internet (even with authentication); attacker knows the address of a users Frigate instance; attacker crafts a specialized page which links to the users Frigate instance; attacker finds a way to get an authenticated user to visit their specialized page and click the button/link. This issue can lead to arbitrary configuration updates for the Frigate server, resulting in denial of service and possible data exfiltration. Version 0.13.0 Beta 3 contains a patch.
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Frigate | Frigate | * | 0.13.0 (including) |
Frigate | Frigate | 0.13.0-beta1 (including) | 0.13.0-beta1 (including) |
Frigate | Frigate | 0.13.0-beta2 (including) | 0.13.0-beta2 (including) |