CVE-2023-45670

Executive Summary

CVE-2023-45670 is a cross-site request forgery (CSRF) vulnerability in Frigate, an open-source network video recorder (NVR) software. The flaw affects all versions of Frigate prior to 0.13.0 Beta 3, specifically targeting the server's configuration update endpoints, which lack sufficient CSRF protection. Successful exploitation allows a remote attacker to trick an authenticated user into unwittingly submitting configuration changes to their Frigate instance, resulting in arbitrary configuration modification, denial of service (DoS), and potential data exfiltration of surveillance footage. Given the rated CVSS score of 7.5 (High), this vulnerability poses a significant risk to organizations deploying internet-exposed Frigate instances.

Technical Analysis

Frigate is a widely adopted open-source NVR solution that integrates with camera systems and provides real-time object detection capabilities via TensorFlow or other inference engines. The application exposes a web-based user interface for administrators to manage camera feeds, recording schedules, detection zones, and other operational parameters.

The vulnerability resides in the configuration management functionality of the web application. Per the CNA title, the affected request handlers are config_save and config_set. These endpoints process unauthenticated HTTP POST requests intended to persist changes to the Frigate configuration file. The NVD description confirms that these endpoints fail to implement any cross-site request forgery protection mechanisms — specifically, there is no CSRF token validation, no same-origin policy enforcement, and no double-submit cookie verification.

CSRF attacks exploit the trust a web application has in a user's authenticated browser session. Because Frigate does not validate the Origin or Referer HTTP headers for requests to the configuration endpoints, a malicious website can initiate HTTP requests to a victim's Frigate instance. When a user with an active authenticated session visits the malicious page, the browser automatically attaches the session cookies (assuming default cookie scoping), making the request appear legitimate to the server.

The attack surface is the web management interface, which listens on the Frigate server's HTTP port. Frigate instances that are exposed to the internet — even those protected by authentication — are susceptible. The configuration endpoints are accessible without additional client-side controls such as CORS pre-flight checks, as CSRF attacks typically rely on simple request content types like application/x-www-form-urlencoded.

The resultant impact of a successful CSRF attack is complete configuration takeover. The attacker can alter recording retention policies, disable detection parameters, redirect output streams, or insert malicious configuration directives. These actions can render the NVR inoperable (denial of service) or compromise the confidentiality of recorded surveillance data.

Insufficient technical detail is available regarding the exact request format accepted by the vulnerable endpoints; however, the attack mechanism is well-understood at the class level (CSRF).

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and NVD description.

Step 1 — Reconnaissance/Target Identification: The attacker must identify a Frigate instance that is publicly accessible. This can be accomplished through internet-wide scanning (e.g., Shodan dorks such as title:"Frigate"), or by harvesting links from forums, social media, or corporate asset inventories. The attacker also needs to learn the specific IP address or hostname of the target's Frigate instance. Additionally, the attacker requires knowledge of the server's configuration schema to craft a payload with valid parameter names.

Step 2 — Triggering the CSRF Flaw: The attacker crafts a malicious HTML page or injects content into a legitimate site (stored XSS on another site, phishing page, etc.). This page contains either an HTML form with auto-submitting JavaScript or an <img>/<iframe> tag that issues HTTP POST requests to the victim's Frigate configuration endpoint. The request targets the config/save or config/set endpoints and includes payload data that corresponds to configuration modifications.

Step 3 — Payload/Execution Method: The attacker lures an authenticated Frigate user to visit the malicious page — via phishing emails, social engineering, or watering-hole attacks. When the victim's browser loads the page, the embedded script automatically submits the forged request. Because the browser automatically includes the victim's existing Frigate session cookie, the request passes authentication checks.

Step 4 — Post-Exploitation Impact: The configuration is modified in the background. The attacker may:

• Change recording retention settings to short periods, causing evidence loss.
• Disable motion detection zones to blind the NVR.
• Point the MQTT broker settings to an attacker-controlled server, exfiltrating event data.
• Insert invalid configuration values that cause service crashes (denial of service).
• Modify authentication settings to establish persistent access for later direct attacks.

The drive-by nature of the CSRF attack requires explicit user interaction (clicking a link or button), which is reflected in the CVSS vector requiring user interaction.

Impact Assessment

The CVSS 3.1 base score for this vulnerability is 7.5 (High).

• Attack Vector (AV): Network — exploitable remotely.
• Attack Complexity (AC): Low — no special conditions.
• Privileges Required (PR): None — the attacker does not need pre-existing access.
• User Interaction (UI): Required — the victim must click a crafted link or visit a malicious page while authenticated.
• Scope (S): Unchanged — the compromise is limited to the Frigate server.
• Confidentiality (C), Integrity (I), Availability (A): All rated High.

Business Impact:

• Surveillance Integrity: Configuration tampering can disable recording, delete footage retention policies, or alter detection algorithms, undermining the security purpose of the NVR.
• Data Exposure: Event metadata, frame snapshots, and configuration data (including camera credentials) may be exfiltrated to attacker-controlled endpoints.
• Operational Downtime: Malicious configuration values can prevent Frigate from restarting or cause persistent service crashes.
• Compliance & Legal: Organizations subject to regulatory requirements for video surveillance (e.g., GDPR, HIPAA for medical facilities, banking regulations) may face fines or legal liabilities if footage is compromised or lost.

Blast Radius: All Frigate instances running versions prior to 0.13.0 Beta 3 are affected. The EPSS score of 0.00393 (32.2nd percentile) indicates low-to-moderate exploitation probability at this time, but the attack vector is trivial once the victim's instance is identified.

Detection Guidance

Sigma Rule

title: Frigate CSRF Exploitation Attempt - Crafted Configuration Change
id: 7f64b9d2-1c3e-4a5f-9a8b-2e4d6f8a1c3b
status: experimental
description: Detects HTTP requests to Frigate config endpoints that may indicate CSRF exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-45670
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    category: webserver
    product: nginx
    service: http
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains:
            - 'config/save'
            - 'config/set'
    filter_false_positive:
        cs-host|endswith: '.fr gateway'
    condition: selection and not filter_false_positive
level: high
falsepositives:
    - Legitimate administrative configuration changes by authorized users

YARA Rule

rule Frigate_CSRF_Exploit_Payload
{
    meta:
        author = "ValterSIT Threat Intelligence"
        description = "Detects HTML payloads crafted to exploit CVE-2023-45670 CSRF in Frigate NVR"
        reference = "CVE-2023-45670"
        date = "2023-11-15"
    strings:
        $config_path1 = "/config/save" ascii wide
        $config_path2 = "/config/set" ascii wide
        $form_marker = "<form" ascii wide
        $js_autosubmit = "submit()" ascii wide
        $js_autosubmit2 = "document.forms[0].submit()" ascii wide
    condition:
        uint16(0) == 0x3C3C or uint16(0) == 0x4D5A or uint16(0) == 0x504B or uint16(0) == 0x1F8B
        and 1 of ($config_path*)
        and ($form_marker or 1 of ($js_autosubmit*))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2023-45670 - Frigate CSRF exploitation attempt on config endpoints"; flow:established,to_server; content:"POST"; http_method; content:"/config/save"; http_uri; nocase; sid:2023456701; rev:1; classtype:attempted-admin; reference:cve,2023-45670; reference:url,nvd.nist.gov/vuln/detail/CVE-2023-45670; priority:1; metadata:created_at 2023_11_15;)
alert http any any -> $HOME_NET any (msg:"CVE-2023-45670 - Frigate CSRF exploitation attempt on config endpoints"; flow:established,to_server; content:"POST"; http_method; content:"/config/set"; http_uri; nocase; sid:2023456702; rev:1; classtype:attempted-admin; reference:cve,2023-45670; reference:url,nvd.nist.gov/vuln/detail/CVE-2023-45670; priority:1; metadata:created_at 2023_11_15;)

Elastic Detection

sequence by host.name with maxspan=1s
  [ network where event.category == "network_traffic" and dns.question.name : "*.frgate*" ]
  [ process where event.category == "process" and process.name : "http*" ]

Note: The above EQL rule is a placeholder for server-side event correlation. A more effective detection at the HTTP layer would utilize filebeat with the HTTP module, combined with the following filter:

any where event.category == "web" and http.request.method == "POST" and url.path in ("/config/save", "/config/set") and not source.ip in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=iis
| where like(uri_path, "%config/save%") OR like(uri_path, "%config/set%")
| stats count by clientip, uri_path, status, useragent
| sort - count
| eval severity = case(status == 200 AND useragent != "-", "HIGH", status == 403, "MEDIUM", 1=1, "LOW")
| where severity = "HIGH" AND NOT clientip IN ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")

Wazuh OSSEC Rule

<group name="frgate,">
  <rule id="100670" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">\./config/save</field>
    <field name="method">POST</field>
    <description>CVE-2023-45670 - POST request to Frigate config/save endpoint (possible CSRF)</description>
    <groups>attack.t1190,</groups>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="100671" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">\./config/set</field>
    <field name="method">POST</field>
    <description>CVE-2023-45670 - POST request to Frigate config/set endpoint (possible CSRF)</description>
    <groups>attack.t1190,</groups>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source: CNA, not independently confirmed).

1. Immediate Mitigations:

   • Restrict network exposure: Do not expose Frigate to the public internet. Place it behind a VPN or restrict access to internal IP ranges via firewall rules.
   • Use a reverse proxy with CSRF protection: Deploy an intermediary reverse proxy (e.g., Nginx, Apache, Traefik) that can enforce Origin/Referer header validation for requests to the Frigate config endpoints.
   • Deploy Web Application Firewall (WAF) rules: Block POST requests to /config/save and /config/set originating from external sources or with missing/forged Referer headers.
   • Educate users: Warn authenticated users not to click links from untrusted sources while logged into Frigate.

2. Patch/Upgrade Steps:

   • Upgrade to Frigate version 0.13.0 Beta 3 or later, which contains the CSRF protection patch as claimed by the CNA.
   • Verify the integrity of the downloaded package (gpg signatures, SHA hashes) prior to deployment.
   • After upgrading, test the configuration save/set functionality to ensure CSRF tokens are now enforced.

3. Long-Term Hardening:

   • Enable multi-factor authentication (MFA) for all Frigate administrative accounts.
   • Implement regular security audits of network-facing services.
   • Consider fronting Frigate with an identity-aware proxy that provides single sign-on and session validation.
   • Subscribe to Frigate release notifications to ensure timely patching for future vulnerabilities.
   • Maintain an asset inventory and ensure no legacy Frigate versions remain deployed in the environment.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-45670 — Official CVE record with description and CVSS metadata.
2. Frigate Project (GitHub): https://github.com/blakeblackshear/frigate (connection failed — verify manually) — Vendor repository; version 0.13.0 Beta 3 contains the claimed patch.
3. CWE-352 (CSRF): https://cwe.mitre.org/data/definitions/352.html — Underlying weakness class documentation.
4. ATT&CK T1190: https://attack.mitre.org/techniques/T1190/ — Exploit Public-Facing Application technique used in the attack chain.
5. CISA Known Exploited Vulnerabilities (KEV): Not listed — no evidence of exploitation in the wild at the time of reporting.

Threat Actor Activity: No known threat actor campaigns or exploit-in-the-wild evidence has been reported for CVE-2023-45670 as of this writing. The PoC status is private/unknown, and no public exploit code exists.