CVE-2023-45672

Executive Summary

CVE-2023-45672 is an unsafe deserialization vulnerability in Frigate, an open-source network video recorder (NVR). Versions prior to 0.13.0 Beta 3 fail to sanitize user-supplied configuration payloads processed by the load_config_with_no_duplicates function, which uses Python's yaml.loader.Loader and permits instantiation of custom constructors. This flaw can lead to unauthenticated remote code execution (RCE) on the target server, though exploitation requires victim interaction — specifically an authenticated user clicking a crafted link — and knowledge of the victim's Frigate instance address. Successful exploitation grants the attacker arbitrary code execution in the context of the Frigate application, potentially leading to full server compromise. The vulnerability is rated CVSS 7.5 (High) and has no known public exploit code or CISA KEV listing.

Technical Analysis

The vulnerability resides in Frigate's configuration save functionality, which is exposed via two endpoints: the web UI path /config and the direct API endpoint /api/config/save. Input to these endpoints initially passes through http.py, where the user-provided data is accepted for processing. The data is then parsed by the load_config_with_no_duplicates function defined in frigate/util/builtin.py.

The root cause of the vulnerability is the use of yaml.loader.Loader within load_config_with_no_duplicates when parsing the incoming configuration data. In PyYAML, the yaml.loader.Loader (as opposed to yaml.safe_load or yaml.loader.SafeLoader) is considered unsafe for untrusted input because it allows the instantiation of arbitrary Python objects via custom YAML constructors and tags. Specifically, YAML supports tags such as !!python/object, !!python/name, and !!python/object/apply, which, when processed by the unsafe loader, trigger Python object creation and potentially execute arbitrary code through specially crafted payloads.

The function load_config_with_no_duplicates does not sanitize the input by converting to a safe loading method. As a result, a malicious YAML payload included in the configuration submission will be processed directly by the unsafe loader, and the payload is executed at line 110 of frigate/util/builtin.py during the parsing phase.

It is important to note that this is not merely a server-side request forgery or command injection — it is a classic insecure deserialization issue. The attacker-supplied YAML payload, when processed by the unsafe loader, can invoke Python built-in functions, constructors, or arbitrary callables. For example, a payload using the !!python/object/apply tag could trigger a call to a system command execution function (e.g., subprocess.Popen or os.system) during the YAML loading process itself.

The attack complexity is rated as High (per CVSS 3.1 scoring implications) because the attacker must satisfy several preconditions: knowing the exact address of the victim's Frigate instance, crafting a malicious web page that links to that instance, and convincing an authenticated user to click the link. However, once the victim clicks, the exploitation does not require the attacker to possess valid credentials — the request is made in the context of the victim's authenticated session, if any, or potentially without authentication if the endpoints are not access-controlled.

The vulnerability is present in all versions of Frigate prior to 0.13.0 Beta 3. Version 0.13.0 Beta 3 contains the patch, which presumably replaces the unsafe yaml.loader.Loader with the safe loader (yaml.safe_load or yaml.loader.SafeLoader), although the exact patch mechanism is not independently confirmed (patch confidence: 2/4).

Exploitation Scenarios

No public exploit code has been identified for this vulnerability. The exploitation chain is inferred from the NVD description and the vulnerability class (unsafe deserialization). The following steps describe the likely attack chain:

Step 1 — Reconnaissance and Target Identification: The attacker must first identify a publicly exposed Frigate instance. Frigate is typically deployed as a home NVR or small-business surveillance solution, often exposed to the internet for remote viewing. The attacker may use Internet-wide scanning (e.g., Shodan, Censys) to discover instances by looking for Frigate-specific HTTP responses, default ports, or web interface fingerprints. The attacker must also confirm the exact URL of the Frigate instance, as this will be used to craft the malicious link. The NVD description states that the vulnerability is most plausibly exploited when Frigate is publicly exposed to the internet, even when authentication is enabled.

Step 2 — Crafting the Malicious Page and Luring the Victim: The attacker crafts a dedicated webpage that contains a malicious link or button pointing to the victim's Frigate instance. This link must be specially formatted to trigger the vulnerable endpoints — either the configuration save UI at /config or the direct API call to /api/config/save. Critically, the attacker must know the victim's Frigate address and craft a link that, when clicked, submits a malformed YAML configuration payload to the vulnerable endpoint. The malicious YAML payload embeds Python object instantiation directives that exploit yaml.loader.Loader.

The attacker must then deliver this link to an authenticated user of the target Frigate instance. Social engineering methods include phishing emails, malicious web pages, forum posts, or direct messaging. The link must be clicked by a user who has an active authenticated session with the Frigate instance, although the NVD description notes the vulnerability "may lead to pre-authenticated Remote Code Execution" — suggesting that authentication may not strictly be required in all configurations.

Step 3 — Triggering the Deserialization Payload: When the authenticated user clicks the malicious link, the browser — carrying the user's session cookies — makes a request to the Frigate endpoint. The payload is submitted to http.py, which forwards the input to load_config_with_no_duplicates in frigate/util/builtin.py. Because this function uses yaml.loader.Loader, the YAML processor recognizes the custom Python tags embedded in the payload and instantiates the specified Python objects. At line 110, the payload is executed, and arbitrary code is run in the context of the Frigate application process. The attacker's payload may, for example, invoke a reverse shell, write a web shell, or modify configuration files.

Step 4 — Post-Exploitation Impact: Once code execution is achieved, the attacker gains full control over the Frigate application. Given that Frigate runs as a network video recorder, the attacker may gain access to recorded surveillance footage, compromise the underlying operating system (if the Frigate process runs with sufficient privileges), pivot to other hosts on the local network, exfiltrate sensitive footage, or deploy persistence mechanisms. Since the attack occurs through the authenticated user's session, observability and attribution may be difficult, as the initial request appears to originate from a legitimate user.

Important note: No public proof-of-concept exists for this vulnerability. The attack chain described above is a logical inference based on the vulnerability class and the endpoints explicitly named in the NVD description. Real-world exploitation may require slight variations in payload construction and delivery, but the core mechanism — abusing unsafe YAML deserialization via configuration-save endpoints — is well-established in the security community.

Impact Assessment

The CVSS v3.1 score for CVE-2023-45672 is 7.5 (High). The informational vector (not provided in the source data) suggests High confidentiality impact, High integrity impact, and High availability impact, mitigated by the high attack complexity and the requirement for user interaction. In practice, however, the actual impact is dependent on the deployment context.

Affected Systems:

• All Frigate deployments running versions prior to 0.13.0 Beta 3.
• Deployments where Frigate is exposed to the internet, even with authentication enabled.
• Deployments where users have an authenticated session and can be tricked into clicking a crafted link.

Business and Operational Impact:

• Confidentiality: Full compromise of recorded video surveillance data — a severe privacy and legal concern for organizations using Frigate for physical security. Attackers may steal footage for extortion or intelligence gathering.
• Integrity: The attacker can alter Frigate configurations, disable recording, modify detection rules, or overwrite configuration files, potentially causing the system to behave unexpectedly or fail to record critical events.
• Availability: Arbitrary code execution could be used to crash the Frigate service, delete stored footage, or render the NVR unusable.
• Lateral Movement: Frigate deployments typically sit on a local network with access to NVR drives and potentially other internal resources. Compromise of the Frigate host could serve as a pivot point into the internal network.

Blast Radius:

• Low end: Single-device deployments (e.g., home user with a single Frigate instance).
• High end: Enterprise or MSP deployments where Frigate manages multiple cameras or is integrated with other systems (e.g., Home Assistant, alerting services). In such cases, the compromise could cascade to adjacent systems.

The CVSS subscores reflect Complexity High (AC:H), meaning the attacker must satisfy multiple external preconditions. However, in a targeted attack scenario where the victim is already authenticated and the attacker has identified the instance, the practical difficulty is moderate — the attacker must simply craft a credible lure. The lack of authentication requirement for the request itself (pre-authenticated RCE) is a significant aggravating factor.

Detection Guidance

The following detection rules target the exploitation of this vulnerability by identifying anomalous YAML payloads or requests to the configuration-save endpoints. These are realistic rules based on public detection engineering patterns for deserialization attacks, adapted to the specifics of this CVE where possible.

Sigma Rule

title: Frigate Unsafe YAML Deserialization Attempt (CVE-2023-45672)
id: f25dcbbd-1d4c-4a5d-8d9e-c1f5e3f2c81a
status: experimental
description: Detects attempts to exploit unsafe YAML deserialization in Frigate via configuration-save endpoints, which may indicate CVE-2023-45672 exploitation.
author: valtersit.analyst
date: 2024-01-15
logsource:
  category: webserver
  product: frigate
  definition: 'Frigate web server access logs or reverse proxy logs'
detection:
  selection_endpoint:
    http.url:
      - '*/api/config/save'
      - '*/config'
  selection_payload:
    http.request_body|contains:
      - '!!python/'
      - '!!python/object'
      - '!!python/name'
      - '!!python/object/apply'
  condition: selection_endpoint and selection_payload
  timeframe: 30s
falsepositives:
  - Legitimate administrators updating configuration if the web interface serializes YAML with unsafe tags (unlikely)
  - Automated configuration tools that use YAML serialization with Python-specific tags
level: high
tags:
  - attack.t1190
  - attack.initial-access
  - cve.2023-45672
  - cwe.502

YARA Rule

rule Frigate_Unsafe_YAML_Deserialization_CVE_2023_45672
{
    meta:
        author = "valtersit.analyst"
        description = "Detects YAML payloads containing unsafe Python deserialization tags targeting Frigate config save endpoints (CVE-2023-45672)"
        cve = "CVE-2023-45672"
        date = "2024-01-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-45672"
    strings:
        $a = "!!python/object" ascii
        $b = "!!python/name" ascii
        $c = "!!python/object/apply" ascii
        $d = "yaml.loader" ascii
        $e = "config/save" ascii nocase
        $f = "load_config_with_no_duplicates" ascii
    condition:
        uint16(0) == 0x2D2D // "--" start of YAML document
        and any of ($a, $b, $c) 
        and (any of ($e, $f) or #a > 2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Frigate Unsafe YAML Deserialization Attempt CVE-2023-45672"; flow:established,to_server; content:"/api/config/save"; http.uri; content:"!!python/"; http.request_body; reference:cve,2023-45672; classtype:attempted-admin; sid:20004567; rev:1;)

Elastic Detection

// Detect POST/PUT requests to Frigate config endpoints with unsafe YAML tags
sequence by source.ip with maxspan=5m
  [network where event.category == "network" and network.protocol == "http"
   and http.request.method in ("POST", "PUT", "PATCH")
   and wildcard(http.request.body.content, "*!!python/*")]
  [http where event.category == "web"
   and (url.path == "/api/config/save" or url.path == "/config")
   and wildcard(http.request.body.content, "*!!python/*")]

Splunk SPL Query

index=proxy OR index=weblogic OR index=access_combined
  (uri="/api/config/save" OR uri="/config")
  AND (form_data="*!!python/object*" OR form_data="*!!python/name*" OR form_data="*!!python/object/apply*")
  | stats count by src_ip, dest_ip, uri, user, _time
  | sort - _time

Wazuh OSSEC Rule

<group name="frigate,">
  <rule id="569596" level="12">
    <if_sid>31420</if_sid>
    <match>!!python/</match>
    <regex>\/api\/config\/save|\/config</regex>
    <description>Frigate (CVE-2023-45672): Unsafe YAML deserialization payload detected in config save request</description>
    <group>frigate,exploitation,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED — single source (CNA) claims patch in 0.13.0 Beta 3; not independently confirmed.

1. Immediate Mitigations (within 24–48 hours):

   • Upgrade Frigate to version 0.13.0 Beta 3 or later immediately. The CNA states this version contains the patch. If upgrading is not immediately feasible, restrict access to the configuration-save endpoints.
   • If the Frigate instance must remain exposed to the internet, implement an access control list (ACL) or reverse-proxy rule that blocks external access to /api/config/save and /config endpoints. Allow only internal/trusted IP addresses to reach these endpoints.
   • Enforce strong authentication and session management. Ensure that session timeouts are in place and that authenticated sessions are tied to IP addresses where possible.
   • Educate authenticated Frigate users about phishing lures that reference their Frigate instance. Warn them not to click links that appear to lead to dashboard settings or configuration pages.

2. Patch/Upgrade Steps:

   • Back up existing Frigate configuration files before upgrading.
   • Upgrade to version 0.13.0 Beta 3 or the latest stable release that contains the fix.
   • After upgrading, verify that the load_config_with_no_duplicates function now uses yaml.safe_load (or an equivalent safe loading method) rather than yaml.loader.Loader. This can be confirmed by reviewing the source code of the installed version.
   • Test all configuration save paths (UI and API) to confirm normal functionality after the upgrade.
   • If the patch is not independently confirmed, monitor the official Frigate repository for confirmed release notes and any additional hotfixes.

3. Long-Term Hardening:

   • Do not expose Frigate directly to the internet. Deploy it behind a hardened reverse proxy (e.g., nginx, Traefik) with mandatory TLS and strict authentication (e.g., OAuth2 proxy, LDAP integration).
   • Run Frigate as a low-privilege service account with minimal OS-level permissions. Restrict filesystem write access to only the directories required for configuration and footage storage.
   • Segment the Frigate host on a dedicated VLAN or network segment to limit lateral movement in case of compromise.
   • Enable comprehensive access logging on both the Frigate service and the reverse proxy. Forward logs to a central SIEM for monitoring.
   • Subscribe to the Frigate GitHub repository or mailing list to receive security advisories promptly.
   • Periodically audit the Frigate configuration for any unaccounted changes, which could indicate prior compromise.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-45672
2. CNA Advisory (Frigate): https://github.com/blakeblackshear/frigate/security/advisories (referenced in CNA data, exact URL inferred)
3. Frigate Official Repository: https://github.com/blakeblackshear/frigate — source of the patched version 0.13.0 Beta 3
4. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CWE-502 — Deserialization of Untrusted Data: https://cwe.mitre.org/data/definitions/502.html

Threat actor activity: No known threat actor campaigns or exploit-in-the-wild evidence have been publicly documented for this CVE as of the time of writing. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. The EPSS score of 0.01387 (69.7th percentile among exploited CVEs) indicates a baseline likelihood of exploitation in the wild, though this is probabilistic and not evidence of active exploitation. The absence of public PoC code and exploit-in-the-wild reporting suggests the vulnerability has not yet attracted broad attacker interest; however, the severity (RCE in a widely deployed open-source NVR) makes it a prime candidate for future weaponization as researchers publish analyses.