octoprint@1.9.0rc4 vulnerabilities

OctoPrint is a snappy web interface for your 3D printer

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the Jinja2 template system. An attacker can retrieve or modify sensitive configuration settings, interrupt prints, or otherwise interact with the instance maliciously.

Note: The attacker has to redirect a victim to a specially crafted link or persuade the victim to click through a malicious third-party app

Upgrade OctoPrint to version 1.10.3 or higher.

OctoPrint is a snappy web interface for your 3D printer

Affected versions of this package are vulnerable to Unverified Password Change due to improper authentication in the settings interface. An attacker can gain unauthorized access to API keys and potentially disrupt system operations by exploiting the lack of reauthentication requirements.

Upgrade OctoPrint to version 1.10.3 or higher.

OctoPrint is a snappy web interface for your 3D printer

Affected versions of this package are vulnerable to Authentication Bypass by Spoofing due to the autologinLocal configuration option. An attacker can bypass authentication controls by spoofing their IP address using the X-Forwarded-For header.

Note: If autologin is not enabled, this vulnerability does not have any impact.

Upgrade OctoPrint to version 1.10.1 or higher.

OctoPrint is a snappy web interface for your 3D printer

Affected versions of this package are vulnerable to Cross-Site Scripting (XSS) due to the misconfiguration of a webcam snapshot URL which, when tested through the "Test" button in the web interface, will execute JavaScript code in the victim's browser during the attempt to render the snapshot image.

An attacker who successfully convinces a victim with admin rights to perform a snapshot test with a maliciously crafted URL could use this to retrieve or modify sensitive configuration settings, interrupt prints, or otherwise interact with the instance in a malicious manner.

Upgrade OctoPrint to version 1.10.0rc3 or higher.

OctoPrint is a snappy web interface for your 3D printer

Affected versions of this package are vulnerable to Unverified Password Change via the access control settings. An attacker can change the password of other admin accounts without having to verify their current password by exploiting this vulnerability. This is only exploitable if the attacker has already hijacked an admin account.

Upgrade OctoPrint to version 1.10.0rc1 or higher.

OctoPrint is a snappy web interface for your 3D printer

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine when the GCODE script is configured maliciously. An attacker can execute arbitrary commands with the rights of the process on the server system and manipulate or extract data by crafting a special script.

Upgrade OctoPrint to version 1.9.3 or higher.