Critical, CVSS 9.3PyPIAmendedPublished
Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service
CVE-2024-32874 · GHSA-w4h6-9wrp-v5jq
- Affected
- PyPI frigate < 0.13.2
- Fixed in
- 0.13.2· Vendor fix available
- Issue
- Important: Exploiting this vulnerability requires the attacker to have access to your Frigate instance, which means they could also just delete all of your recordings or perform any other action. If you have configured authentication in front of Frigate via a reverse proxy, then this vulnerability is not exploitable without first getting around your authentication method. For many obvious reasons in addition to this one, please don't expose your Frigate instance publicly without any kind of authentication. Summary When uploading a file or retrieving the filename, a user may intentionally use a large Unicode filename which would lead to a application-level denial of service. This is due to no limitation set on the length of the filename and the costy use of the Unicode normalization with the form NFKD under the hood of `secure_filename()`. I idenfied multiple vulnerable paths on blakeblackshear/frigate repository. In all of…
Recommended action: Upgrade to 0.13.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.