CVE-2023-45671 Frigate reflected XSS through `/<camera_name>` API endpoints
Reflected XSS in Frigate allows arbitrary JavaScript execution if an authenticated user clicks a crafted link, requiring specific knowledge of the server address.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-45671?
CVE-2023-45671 is a medium-severity cross-site scripting vulnerability in blakeblackshear frigate, published on 30 Oct 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the `/<camera_name>` base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to both know very specific information about a user's Frigate server and requires an authenticated user to be tricked into clicking a specially crafted link to their Frigate instance. This vulnerability could exploited by an attacker under the following circumstances: Frigate publicly exposed to the internet (even with authentication); attacker knows the address of a user's Frigate instance; attacker crafts a specialized page which links to the user's Frigate instance; attacker finds a way to get an authenticated user to visit their specialized page and click the button/link. As the reflected values included in the URL are not sanitized or escaped, this permits execution arbitrary Javascript payloads. Version 0.13.0 Beta 3 contains a patch for this issue.
Weakness: CWE-79
Which versions are affected by CVE-2023-45671?
It affects 1 product.
Products include Frigate Frigate.
How do I fix CVE-2023-45671?
No fix has been published for CVE-2023-45671 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-45671 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-45671 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in blakeblackshear frigate
- CVE-2026-25643 Frigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape
- CVE-2026-33124 Frigate has insecure password change functionality
- CVE-2023-45670 Frigate cross-site request forgery in `config_save` and `config_set` request handlers
- CVE-2023-45672 Frigate unsafe deserialization in `load_config_with_no_duplicates` of `frigate/util/builtin.py`
- CVE-2026-33125 Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts
Sources
Also known as GHSA-jjxc-m35j-p56f.