PT-2023-6631 · Octoprint · Octoprint

Rggu2Zr · Published 2023-10-09 · Updated 2023-10-13 · CVE-2023-41047

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OctoPrint versions up to and including 1.9.2

Description The issue allows malicious administrators to configure a specially crafted GCODE script, enabling code execution during the rendering of that script. This could be used to extract or manipulate data managed by OctoPrint, as well as execute arbitrary commands with the rights of the OctoPrint process on the server system. More than 20,000 OctoPrint instances are currently accessible online.

Recommendations For OctoPrint versions up to and including 1.9.2, update to version 1.9.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the GCODE script configuration to trusted administrators only, and avoid configuring arbitrary GCODE scripts found online or provided by third parties.

Exploit

Fix

Weakness Enumeration

CWE-1336

Related Identifiers

BDU:2023-07399

CVE-2023-41047

GHSA-FWFG-VPRH-97PH

PYSEC-2023-195

Affected Products

Octoprint

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41047.json · Exploit
• https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-fwfg-vprh-97ph · Vendor Advisory
• https://github.com/OctoPrint/OctoPrint/commit/d0072cff894509c77e243d6562245ad3079e17db · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-41047 · Security Note
• https://bdu.fstec.ru/vul/2023-07399 · Security Note
• https://osv.dev/vulnerability/CVE-2023-41047 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fwfg-vprh-97ph · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-195 · Vendor Advisory
• https://github.com/OctoPrint/OctoPrint · Note
• https://github.com/OctoPrint/OctoPrint/releases/tag/1.9.3 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/octoprint/PYSEC-2023-195.yaml · Note
• https://t.me/true_secator/4962 · Telegram Post