CyberRota Analysis
AI-GeneratedThe vulnerability affects Frigate versions prior to 0.18.0, specifically within the Nginx configuration, where the /api/go2rtc/api endpoint allows authenticated viewer users to access sensitive information without requiring an administrator role. This exposure can lead to unauthorized retrieval of internal addresses, configuration paths, and RTSP stream URLs, potentially compromising camera credentials. Organizations using Frigate with Nginx or Docker should prioritize upgrading to version 0.18.0 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users. An authenticated viewer can request the streams, config, log, and stack subpaths to obtain internal addresses, configuration paths, application logs, goroutine stack data, and RTSP stream URLs that may contain camera credentials. Non-GET methods remain blocked by limit_except GET. This issue is fixed in version 0.18.0.