CVE-2023-45670 Frigate cross-site request forgery in `config_save` and `config_set` request handlers
Attackers can modify Frigate server configuration via CSRF, potentially causing denial of service or data exfiltration if users are tricked into clicking malicious links.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-45670?
CVE-2023-45670 is a high-severity vulnerability in blakeblackshear frigate, published on 30 Oct 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, the `config/save` and `config/set` endpoints of Frigate do not implement any CSRF protection. This makes it possible for a request sourced from another site to update the configuration of the Frigate server (e.g. via "drive-by" attack). Exploiting this vulnerability requires the attacker to both know very specific information about a user's Frigate server and requires an authenticated user to be tricked into clicking a specially crafted link to their Frigate instance. This vulnerability could exploited by an attacker under the following circumstances: Frigate publicly exposed to the internet (even with authentication); attacker knows the address of a user's Frigate instance; attacker crafts a specialized page which links to the user's Frigate instance; attacker finds a way to get an authenticated user to visit their specialized page and click the button/link. This issue can lead to arbitrary configuration updates for the Frigate server, resulting in denial of service and possible data exfiltration. Version 0.13.0 Beta 3 contains a patch.
Weakness: CWE-352
Which versions are affected by CVE-2023-45670?
It affects 1 product.
Products include Frigate Frigate.
How do I fix CVE-2023-45670?
No fix has been published for CVE-2023-45670 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-45670 being exploited?
There is no known exploitation of CVE-2023-45670 in the wild and no public exploit code.
Other vulnerabilities in blakeblackshear frigate
- CVE-2026-25643 Frigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape
- CVE-2026-33124 Frigate has insecure password change functionality
- CVE-2023-45672 Frigate unsafe deserialization in `load_config_with_no_duplicates` of `frigate/util/builtin.py`
- CVE-2026-33125 Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts
- CVE-2026-33469 Authenticated Frigate users can read the full unredacted configuration via `/api/config/raw
Sources
Also known as GHSA-xq49-hv88-jr6h.