CVE-2023-45672
📋 TL;DR
Frigate network video recorder versions before 0.13.0 Beta 3 contain an unsafe YAML deserialization vulnerability in configuration endpoints. This allows unauthenticated remote code execution when attackers trick authenticated users into visiting malicious links to their Frigate instance. All Frigate installations exposed to the internet with authentication enabled are affected.
💻 Affected Systems
- Frigate Network Video Recorder
📦 What is this software?
Frigate by Frigate
Frigate by Frigate
Frigate by Frigate
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the Frigate server and potentially pivoting to other systems.
Likely Case
Attacker executes arbitrary code on the Frigate server, potentially accessing video feeds, modifying configurations, or installing persistence mechanisms.
If Mitigated
No impact if Frigate is not internet-facing and proper network segmentation prevents user access to malicious external content.
🎯 Exploit Status
Exploitation requires social engineering to trick authenticated users, but technical payload execution is straightforward once user interaction is achieved.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.13.0 Beta 3 and later
Vendor Advisory: https://github.com/blakeblackshear/frigate/security/advisories/GHSA-qp3h-4q62-p428
Restart Required: Yes
Instructions:
1. Backup current Frigate configuration. 2. Stop Frigate service. 3. Update to version 0.13.0 Beta 3 or later using your deployment method (Docker, manual install, etc.). 4. Restart Frigate service. 5. Verify version is updated.
🔧 Temporary Workarounds
Network Isolation
linuxRestrict access to Frigate web interface to trusted networks only
iptables -A INPUT -p tcp --dport 5000 -s TRUSTED_NETWORK -j ACCEPT
iptables -A INPUT -p tcp --dport 5000 -j DROP
Reverse Proxy Restrictions
allConfigure reverse proxy to block or restrict access to vulnerable endpoints
location ~ ^/(config|api/config/save) { deny all; }
🧯 If You Can't Patch
- Implement strict network segmentation to prevent Frigate from being accessible from untrusted networks
- Deploy web application firewall rules to block malicious YAML payloads targeting configuration endpoints
🔍 How to Verify
Check if Vulnerable:
Check Frigate version via web interface or API. If version is below 0.13.0 Beta 3, system is vulnerable.Check Version:
curl -s http://frigate-host:5000/api/version | grep versionVerify Fix Applied:
Confirm version is 0.13.0 Beta 3 or higher. Test that /api/config/save endpoint properly validates and sanitizes YAML input.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /config or /api/config/save endpoints
- YAML parsing errors containing suspicious Python class names
- Unexpected process execution from Frigate service
Network Indicators:
- HTTP requests with YAML payloads containing '!!python' tags or custom constructors
- Traffic to Frigate from unexpected sources
SIEM Query:
source="frigate.logs" AND (uri_path="/config" OR uri_path="/api/config/save") AND (payload="!!python" OR payload="__import__" OR payload="os.system")🔗 References
- https://github.com/blakeblackshear/frigate/blob/5658e5a4cc7376504af9de5e1eff178939a13e7f/frigate/config.py#L1244-L1244
- https://github.com/blakeblackshear/frigate/blob/5658e5a4cc7376504af9de5e1eff178939a13e7f/frigate/http.py#L998-L998
- https://github.com/blakeblackshear/frigate/blob/5658e5a4cc7376504af9de5e1eff178939a13e7f/frigate/util/builtin.py#L110-L110
- https://github.com/blakeblackshear/frigate/security/advisories/GHSA-qp3h-4q62-p428
- https://securitylab.github.com/advisories/GHSL-2023-190_Frigate/
- https://github.com/blakeblackshear/frigate/blob/5658e5a4cc7376504af9de5e1eff178939a13e7f/frigate/config.py#L1244-L1244
- https://github.com/blakeblackshear/frigate/blob/5658e5a4cc7376504af9de5e1eff178939a13e7f/frigate/http.py#L998-L998
- https://github.com/blakeblackshear/frigate/blob/5658e5a4cc7376504af9de5e1eff178939a13e7f/frigate/util/builtin.py#L110-L110
- https://github.com/blakeblackshear/frigate/security/advisories/GHSA-qp3h-4q62-p428
- https://securitylab.github.com/advisories/GHSL-2023-190_Frigate/
