octoprint@1.9.0rc4 vulnerabilities

OctoPrint is a snappy web interface for your 3D printer

Affected versions of this package are vulnerable to Command Injection due to upload file when a specially crafted filename is included in a command defined in a system event handler and the corresponding event is triggered. An attacker can execute arbitrary system commands by uploading a file with a malicious filename if event handlers are configured to use uploaded filenames as command parameters.

Note: This is only exploitable if event handlers are configured to execute system commands with uploaded filenames as parameters.

Upgrade OctoPrint to version 1.11.3 or higher.

OctoPrint is a snappy web interface for your 3D printer

Affected versions of this package are vulnerable to Improper Neutralization through the UploadStorageFallbackHandler request handler. An attacker can make the web server component become unresponsive by sending a manipulated broken multipart/form-data request lacking an end boundary.

Upgrade OctoPrint to version 1.11.2 or higher.

OctoPrint is a snappy web interface for your 3D printer

Affected versions of this package are vulnerable to External Control of File Name or Path via the upload endpoints. An attacker with the FILE_UPLOAD permission can move files from the host into the upload folder, from where they can be subsequently downloaded.

Upgrade OctoPrint to version 1.11.2 or higher.

OctoPrint is a snappy web interface for your 3D printer

Affected versions of this package are vulnerable to User Impersonation via the X-Preemptive-Recording HTTP header. An attacker could bypass the login redirect and directly access the HTML of certain frontend pages by adding the HTTP header X-Preemptive-Recording: yes to HTTP requests.

Notes:

1. The impact on data exposure is minimal because, typically, data is loaded via API requests that correctly enforce user authentication. The primary risk lies in potential future modifications to the codebase that might incorrectly rely on vulnerable internal functions for authentication checks, leading to security vulnerabilities.

2. The vulnerability affects the functions require_login, require_login_with, and require_fresh_login_with in octoprint/server/util/init.py file.

Upgrade OctoPrint to version 1.11.0 or higher.

OctoPrint is a snappy web interface for your 3D printer

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the Jinja2 template system. An attacker can retrieve or modify sensitive configuration settings, interrupt prints, or otherwise interact with the instance maliciously.

Note: The attacker has to redirect a victim to a specially crafted link or persuade the victim to click through a malicious third-party app

Upgrade OctoPrint to version 1.10.3 or higher.

OctoPrint is a snappy web interface for your 3D printer

Affected versions of this package are vulnerable to Unverified Password Change due to improper authentication in the settings interface. An attacker can gain unauthorized access to API keys and potentially disrupt system operations by exploiting the lack of reauthentication requirements.

Upgrade OctoPrint to version 1.10.3 or higher.

OctoPrint is a snappy web interface for your 3D printer

Affected versions of this package are vulnerable to Authentication Bypass by Spoofing due to the autologinLocal configuration option. An attacker can bypass authentication controls by spoofing their IP address using the X-Forwarded-For header.

Note: If autologin is not enabled, this vulnerability does not have any impact.

Upgrade OctoPrint to version 1.10.1 or higher.

OctoPrint is a snappy web interface for your 3D printer

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to the misconfiguration of a webcam snapshot URL which, when tested through the "Test" button in the web interface, will execute JavaScript code in the victim's browser during the attempt to render the snapshot image.

An attacker who successfully convinces a victim with admin rights to perform a snapshot test with a maliciously crafted URL could use this to retrieve or modify sensitive configuration settings, interrupt prints, or otherwise interact with the instance in a malicious manner.

Upgrade OctoPrint to version 1.10.0rc3 or higher.

OctoPrint is a snappy web interface for your 3D printer

Affected versions of this package are vulnerable to Unverified Password Change via the access control settings. An attacker can change the password of other admin accounts without having to verify their current password by exploiting this vulnerability. This is only exploitable if the attacker has already hijacked an admin account.

Upgrade OctoPrint to version 1.10.0rc1 or higher.