PT-2022-4232 · Octoprint · Octoprint

Published 2022-08-15 · Updated 2022-08-16 · CVE-2022-2822

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:N/C:C/I:P/A:P

Name of the Vulnerable Software and Affected Versions OctoPrint versions 1.7.3 and prior

Description The issue is related to insufficient restriction of authentication attempts, allowing a remote attacker to bypass security restrictions using a brute force attack. This can enable an attacker to freely brute force username and password, taking over any account, including user and administrative accounts. The severity of this issue is limited by OctoPrint normally running in a restricted LAN.

Recommendations For OctoPrint versions 1.7.3 and prior, consider updating to a version that includes rate limiting on the login page, such as versions from the devel and maintenance branches of the repository, which limit the rate of failed login attempts. As a temporary workaround, consider restricting access to the login page to minimize the risk of exploitation.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

BDU:2022-05080

CVE-2022-2822

GHSA-5W5X-Q9P5-9QG3

Affected Products

Octoprint

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2822.json · Exploit
• 🔥 https://huntr.dev/bounties/6369f355-e6ef-4469-af75-0f6ff00cde3d · Exploit
• https://github.com/octoprint/octoprint/commit/82c892ba40b3741d1b7711d949e56af64f5bc2de · Patch
• https://bdu.fstec.ru/vul/2022-05080 · Security Note
• https://osv.dev/vulnerability/GHSA-5w5x-q9p5-9qg3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2822 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2822 · Vendor Advisory
• https://github.com/octoprint/octoprint · Note
• https://t.me/cibsecurity/48133 · Telegram Post