Frigate Professional Buffer Overflow Vulnerability in 'Find Computer' Feature Allowing Arbitrary Code Execution

A local buffer overflow vulnerability has been identified in Frigate Professional version 3.36.0.9, specifically within the 'Find Computer' feature. This vulnerability allows attackers to execute arbitrary code by overflowing the computer name input field. Exploitation involves crafting a malicious payload that triggers the buffer overflow, leading to unauthorized code execution. As a proof of concept, the Windows calculator application is launched.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system.

Reproduction

The vulnerability can be reproduced by turning off Data Execution Prevention (DEP) for the Frigate3.exe process. After launching Frigate Professional 3.36.0.9, navigate to the 'Disk' menu and select 'Find Computer'. Paste the crafted payload into the 'Computer Name' field and click 'OK'. The payload execution can be verified by the successful launch of calc.exe.