PT-2024-25024 · Octoprint · Octoprint

Jacopotediosi · Published 2024-05-14 · Updated 2024-05-14 · CVE-2024-32977

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions OctoPrint versions up to and including 1.10.0

Description OctoPrint provides a web interface for controlling consumer 3D printers. The issue allows an unauthenticated attacker to bypass authentication if the autologinLocal option is enabled within config.yaml, even if they come from networks that are not configured as localNetworks, by spoofing their IP via the X-Forwarded-For header. This vulnerability does not have any impact if autologin is not enabled.

Recommendations For OctoPrint versions up to and including 1.10.0, update to version 1.10.1 to resolve the issue. As a temporary workaround, consider disabling the autologinLocal option within config.yaml until a patch is applied. Restrict access to the instance from potentially hostile networks like the internet to minimize the risk of exploitation.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2024-32977

GHSA-2VJQ-HG5W-5GM7

PYSEC-2024-237

Affected Products

Octoprint

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32977.json · Exploit
• https://github.com/OctoPrint/OctoPrint/commit/5afbec8d23508edc25b0f1bdef1620580136add4 · Patch
• https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-2vjq-hg5w-5gm7 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2vjq-hg5w-5gm7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32977 · Security Note
• https://osv.dev/vulnerability/PYSEC-2024-237 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-32977 · Vendor Advisory
• https://github.com/OctoPrint/OctoPrint · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/octoprint/PYSEC-2024-237.yaml · Note