CVE-2024-32874

Executive Summary

CVE-2024-32874 is a denial-of-service (DoS) vulnerability affecting Frigate, an open-source network video recorder (NVR) with real-time local object detection for IP cameras. The vulnerability resides in the file upload and filename retrieval functionality. An unauthenticated attacker can intentionally provide a large Unicode filename, which triggers an expensive Unicode normalization process (NFKD) within the secure_filename() function. This leads to excessive CPU consumption, causing an application-level denial of service. The vulnerability is present in all versions prior to 0.13.2. The CVSS score is 6.8 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood in the wild. No public proof-of-concept (PoC) or exploit code is available at this time.

Supply Chain & Package Security

Frigate is a Python-based application distributed via Docker images and GitHub releases. The vulnerability is introduced through the use of the secure_filename() function from the werkzeug library, which performs NFKD normalization. While the library itself is not vulnerable, the lack of input length validation in Frigate's codebase creates the attack vector. Users should ensure they are using the latest patched version (0.13.2) and verify the integrity of their Docker images via checksums.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): Low (L) – The service becomes unresponsive or slow.

CVSS Score: 6.8 (Medium)
Threat Level: Medium – While the impact is limited to availability, the attack is trivial to execute and requires no authentication.

Deep Dive & Mechanics

The vulnerability is rooted in the secure_filename() function from the werkzeug library, which is used by Frigate to sanitize uploaded filenames. This function performs Unicode normalization using the NFKD (Normalization Form Compatibility Decomposition) form. NFKD normalization is computationally expensive for certain Unicode characters, especially those that decompose into many base characters (e.g., certain emoji sequences or combining characters).

When an attacker uploads a file with an extremely long Unicode filename (e.g., thousands of characters), the normalization process consumes significant CPU resources. Since there is no upper limit on the filename length in Frigate's code, the server can be overwhelmed, leading to a denial of service. The attack does not require authentication and can be repeated to sustain the DoS condition.

The vulnerable code path is triggered during file upload and when retrieving the filename for display or storage. The secure_filename() function is called on the user-supplied filename without prior length validation.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-0.13.2):

from werkzeug.utils import secure_filename

def handle_upload(file):
    filename = secure_filename(file.filename)
    # No length check on filename before normalization
    file.save(os.path.join(UPLOAD_FOLDER, filename))

Patched Code (0.13.2):

from werkzeug.utils import secure_filename

MAX_FILENAME_LENGTH = 255

def handle_upload(file):
    filename = file.filename
    if len(filename) > MAX_FILENAME_LENGTH:
        raise ValueError("Filename too long")
    filename = secure_filename(filename)
    file.save(os.path.join(UPLOAD_FOLDER, filename))

The patch introduces a maximum filename length check (255 characters) before calling secure_filename(), preventing the expensive normalization of overly long Unicode strings.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Frigate instance (version < 0.13.2) accessible over the network.
• The file upload endpoint must be exposed (typically /api/upload or similar).

Exploitation Steps:

1. Generate a malicious Unicode filename. For example, a string of 10,000 characters consisting of combining characters (e.g., a followed by many combining accents).
2. Send a POST request to the file upload endpoint with the malicious filename.
3. Repeat the request multiple times to amplify the DoS effect.

Example using curl:

# Generate a long Unicode filename (e.g., 10,000 'a' characters with combining accents)
filename=$(python3 -c "print('a' + '\u0300'*10000)")

# Send the malicious upload request
curl -X POST -F "file=@/dev/null;filename=$filename" http://target.frigate/api/upload

Expected Outcome: The Frigate service becomes unresponsive or extremely slow, impacting all users.

Blue Team

Detection:

• Monitor for unusually long filenames in upload requests.
• Look for high CPU usage on the Frigate server correlated with file upload activity.
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Immediately upgrade to Frigate 0.13.2 or later.
• If upgrading is not possible, implement a reverse proxy (e.g., Nginx) to limit request body size and reject filenames exceeding a reasonable length.
• Restrict access to the file upload endpoint to trusted IPs only.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /api/upload with filenames exceeding 255 characters.
• System: High CPU usage by the Frigate process (e.g., frigate or python3).
• Logs: Frigate logs may show errors like ValueError: Filename too long after patching, or excessive processing times for uploads.
• File System: Temporary files with extremely long names in the upload directory (if any are saved before normalization).

Detection Engineering

YARA Rule

rule CVE_2024_32874_Frigate_Unicode_DoS {
    meta:
        description = "Detects attempts to exploit CVE-2024-32874 via long Unicode filenames"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-32874"
    strings:
        $long_unicode = /[\x{0080}-\x{10FFFF}]{256,}/  // Matches 256+ Unicode characters
    condition:
        $long_unicode
}

Sigma Rule

title: Frigate Unicode Filename DoS Attempt
id: 7a8b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests with excessively long Unicode filenames targeting Frigate upload endpoints
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/upload'
        cs-uri-query|contains: 'filename='
        cs-uri-query|length: >= 256
    condition: selection
falsepositives:
    - Legitimate uploads with long filenames (unlikely)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-32874 Frigate Unicode Filename DoS Attempt";
    flow:to_server;
    content:"POST";
    http_method;
    content:"/api/upload";
    http_uri;
    pcre:"/filename=[^&]{256,}/i";
    classtype:attempted-dos;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate:

• Upgrade Frigate to version 0.13.2 or later. This is the only complete fix.
• If upgrade is not possible, implement a reverse proxy (e.g., Nginx) with the following configuration to limit request body size and reject long filenames:

location /api/upload {
    client_max_body_size 10m;
    if ($arg_filename ~* ".{256,}") {
        return 413;
    }
}

Long-term:

• Conduct a code review to ensure all user inputs are validated for length and content before processing.
• Implement rate limiting on the upload endpoint to prevent abuse.
• Monitor for similar vulnerabilities in dependencies (e.g., werkzeug).

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.