CVE-2023-45672 : Vulnerability Insights and Analysis

Frigate unsafe deserialization vulnerability in

load_config_with_no_duplicates

of

frigate/util/builtin.py

.

Understanding CVE-2023-45672

Frigate, an open-source network video recorder, was found to have an unsafe deserialization vulnerability before version 0.13.0 Beta 3. The vulnerability exists in the endpoints used for saving configurations, potentially leading to unauthenticated remote code execution.

What is CVE-2023-45672?

Prior to version 0.13.0 Beta 3, an unsafe deserialization vulnerability was identified in Frigate's configuration-saving endpoints. This flaw could allow an attacker to execute remote code without authentication.

The Impact of CVE-2023-45672

The vulnerability could be exploited if specific information about a user's Frigate server is known to the attacker. Through crafted links, authenticated users can be tricked into clicking on them, leading to potential remote code execution.

Technical Details of CVE-2023-45672

The vulnerability lies in user-provided input accepted through

http.py

, parsed, and loaded by

load_config_with_no_duplicates

without proper sanitization. This could result in direct code execution at

frigate/util/builtin.py:110

. Version 0.13.0 Beta 3 includes a fix for this issue.

Vulnerability Description

User input accepted by

load_config_with_no_duplicates

is not sanitized, allowing for potential remote code execution via crafted payloads.

Affected Systems and Versions

Vendor: blakeblackshear
Product: frigate
Affected Versions: < 0.13.0-beta3

Exploitation Mechanism

An attacker needs to know specific information about a user's Frigate instance and trick an authenticated user into clicking a malicious link to execute the payload.

Mitigation and Prevention

To mitigate the CVE-2023-45672 vulnerability, consider the following steps:

Immediate Steps to Take

Update Frigate to version 0.13.0 Beta 3 or later to apply the necessary patch.

Long-Term Security Practices

Always keep software up to date to prevent known vulnerabilities from being exploited.
Regularly review and improve access controls to minimize the attack surface.

Patching and Updates

Stay informed about security advisories and apply patches promptly to address vulnerabilities.