Homepage

octoprint@1.11.0rc4 vulnerabilities

The snappy web interface for your 3D printer

  • latest version

    1.11.5

  • latest non vulnerable version

    1.11.5

  • first published

    6 years ago

  • latest version published

    12 days ago

  • licenses detected

  • View octoprint package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the octoprint package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • L
    Cross-site Scripting (XSS)

    OctoPrint is a snappy web interface for your 3D printer

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the Action Command Notification plugin and the Action Command Prompt plugin. An attacker can execute arbitrary scripts in the context of the user's browser by convincing a victim to print a specially crafted file. This can lead to disruption of ongoing prints, extraction of sensitive information, or execution of actions on behalf of the user within the application.

    How to fix Cross-site Scripting (XSS)?

    Upgrade OctoPrint to version 1.11.4 or higher.

    [,1.11.4)
    • H
    Command Injection

    OctoPrint is a snappy web interface for your 3D printer

    Affected versions of this package are vulnerable to Command Injection due to upload file when a specially crafted filename is included in a command defined in a system event handler and the corresponding event is triggered. An attacker can execute arbitrary system commands by uploading a file with a malicious filename if event handlers are configured to use uploaded filenames as command parameters.

    Note: This is only exploitable if event handlers are configured to execute system commands with uploaded filenames as parameters.

    How to fix Command Injection?

    Upgrade OctoPrint to version 1.11.3 or higher.

    [,1.11.3)
    • H
    Improper Neutralization

    OctoPrint is a snappy web interface for your 3D printer

    Affected versions of this package are vulnerable to Improper Neutralization through the UploadStorageFallbackHandler request handler. An attacker can make the web server component become unresponsive by sending a manipulated broken multipart/form-data request lacking an end boundary.

    How to fix Improper Neutralization?

    Upgrade OctoPrint to version 1.11.2 or higher.

    [,1.11.2)
    • M
    External Control of File Name or Path

    OctoPrint is a snappy web interface for your 3D printer

    Affected versions of this package are vulnerable to External Control of File Name or Path via the upload endpoints. An attacker with the FILE_UPLOAD permission can move files from the host into the upload folder, from where they can be subsequently downloaded.

    How to fix External Control of File Name or Path?

    Upgrade OctoPrint to version 1.11.2 or higher.

    [,1.11.2)
    • M
    User Impersonation

    OctoPrint is a snappy web interface for your 3D printer

    Affected versions of this package are vulnerable to User Impersonation via the X-Preemptive-Recording HTTP header. An attacker could bypass the login redirect and directly access the HTML of certain frontend pages by adding the HTTP header X-Preemptive-Recording: yes to HTTP requests.

    Notes:

    1. The impact on data exposure is minimal because, typically, data is loaded via API requests that correctly enforce user authentication. The primary risk lies in potential future modifications to the codebase that might incorrectly rely on vulnerable internal functions for authentication checks, leading to security vulnerabilities.

    2. The vulnerability affects the functions require_login, require_login_with, and require_fresh_login_with in octoprint/server/util/init.py file.

    How to fix User Impersonation?

    Upgrade OctoPrint to version 1.11.0 or higher.

    [,1.11.0)
    Go back to all versions of this package