GHSA-5626-pw9c-hmjr CVE-2024-23637 PYSEC-2024-29
OctoPrint Unverified Password Change via Access Control Settings
- Severity
- 4.2 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.52%
- Chance of exploitation in the next 30 days. Higher than 44.12% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Fix
1.10.0rc1- Upgrade octoprint to this version or later
Description
Impact
OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password.
An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance.
Patches
The vulnerability will be patched in version 1.10.0.
Workarounds
OctoPrint administrators are strongly advised to thoroughly vet who has admin access to their installation.
Credits
This vulnerability was discovered and responsibly disclosed to OctoPrint by Timothy "TK" Ruppert.
Affected versions
PyPI
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
octoprint PyPI → 1.10.0rc1
- pip
pip install --upgrade "octoprint>=1.10.0rc1"- poetry
poetry add "octoprint>=1.10.0rc1"- uv
uv add "octoprint>=1.10.0rc1"
Severity breakdown
CVSS 3.1 4.2
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- High
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Weakness
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How to prevent it
- Architecture and Design: Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
CWE-620: Unverified Password Change
When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
How to prevent it
- Architecture and Design: When prompting for a password change, force the user to provide the original password in addition to the new password.
- Architecture and Design: Do not use "forgotten password" functionality. But if you must, ensure that you are only providing information to the actual user, e.g. by using an email address or challenge question that the legitimate user already provided in the past; do not allow the current user to change this identity information until the correct password has been provided.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-j4h9-pm27-4rfw OctoPrint has possible file exfiltration via query parameters on upload endpoints | High | Also affects octoprint |
| GHSA-p6qx-ghxm-389h OctoPrint has XSS in its Suppressed Command Notifications | Medium | Also affects octoprint |
| GHSA-xg4x-w2j3-57h6 OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication | Medium | Also affects octoprint |
| GHSA-crvm-xjhm-9h29 OctoPrint vulnerable to XSS in Action Commands Notification and Prompt | Medium | Also affects octoprint |
| GHSA-49mj-x8jp-qvfc OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload | High | Also affects octoprint |
| GHSA-9wj4-8h85-pgrw OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint | Medium | Also affects octoprint |
| GHSA-m9jh-jf9h-x3h2 OctoPrint vulnerable to possible file extraction via upload endpoints | Medium | Also affects octoprint |
| GHSA-qw93-h6pf-226x OctoPrint Authenticated Reverse Proxy Page Authentication Bypass | Medium | Also affects octoprint |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor