pysec - pysec-2024-201

pysec-2024-201

Vulnerability from pysec

Published

2024-11-05 19:15

Modified

2025-01-19 16:22

Severity ?

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain reflected XSS vulnerabilities in the login dialog and the standalone application key confirmation dialog. An attacker who successfully talked a victim into clicking on a specially crafted login link, or a malicious app running on a victim's computer triggering the application key workflow with specially crafted parameters and then redirecting the victim to the related standalone confirmation dialog could use this to retrieve or modify sensitive configuration settings, interrupt prints or otherwise interact with the OctoPrint instance in a malicious way. The above mentioned specific vulnerabilities of the login dialog and the standalone application key confirmation dialog have been patched in the bugfix release 1.10.3 by individual escaping of the detected locations. A global change throughout all of OctoPrint's templating system with the upcoming 1.11.0 release will handle this further, switching to globally enforced automatic escaping and thus reducing the attack surface in general. The latter will also improve the security of third party plugins. During a transition period, third party plugins will be able to opt into the automatic escaping. With OctoPrint 1.13.0, automatic escaping will be switched over to be enforced even for third party plugins, unless they explicitly opt-out.

Impacted products

Name	purl
octoprint	pkg:pypi/octoprint

Aliases

JSON

To clipboard

{
   affected: [
      {
         package: {
            ecosystem: "PyPI",
            name: "octoprint",
            purl: "pkg:pypi/octoprint",
         },
         ranges: [
            {
               events: [
                  {
                     introduced: "0",
                  },
                  {
                     fixed: "1.10.3",
                  },
               ],
               type: "ECOSYSTEM",
            },
         ],
         versions: [
            "1.10.0",
            "1.10.0rc1",
            "1.10.0rc2",
            "1.10.0rc3",
            "1.10.0rc4",
            "1.10.1",
            "1.10.2",
            "1.3.11",
            "1.3.12",
            "1.3.12rc1",
            "1.3.12rc3",
            "1.4.0",
            "1.4.0rc1",
            "1.4.0rc2",
            "1.4.0rc3",
            "1.4.0rc4",
            "1.4.0rc5",
            "1.4.0rc6",
            "1.4.1",
            "1.4.1rc1",
            "1.4.1rc2",
            "1.4.1rc3",
            "1.4.1rc4",
            "1.4.2",
            "1.5.0",
            "1.5.0rc1",
            "1.5.0rc2",
            "1.5.0rc3",
            "1.5.1",
            "1.5.2",
            "1.5.3",
            "1.6.0",
            "1.6.0rc1",
            "1.6.0rc2",
            "1.6.0rc3",
            "1.6.1",
            "1.7.0",
            "1.7.0rc1",
            "1.7.0rc2",
            "1.7.0rc3",
            "1.7.1",
            "1.7.2",
            "1.7.3",
            "1.8.0",
            "1.8.0rc1",
            "1.8.0rc2",
            "1.8.0rc3",
            "1.8.0rc4",
            "1.8.0rc5",
            "1.8.1",
            "1.8.2",
            "1.8.3",
            "1.8.4",
            "1.8.5",
            "1.8.6",
            "1.8.7",
            "1.9.0",
            "1.9.0rc1",
            "1.9.0rc2",
            "1.9.0rc3",
            "1.9.0rc4",
            "1.9.0rc5",
            "1.9.0rc6",
            "1.9.1",
            "1.9.2",
            "1.9.3",
         ],
      },
   ],
   aliases: [
      "CVE-2024-49377",
      "GHSA-xvxq-g8hw-fx4g",
   ],
   details: "OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain reflected XSS vulnerabilities in the login dialog and the standalone application key confirmation dialog.  An attacker who successfully talked a victim into clicking on a specially crafted login link, or a malicious app running on a victim's computer triggering the application key workflow with specially crafted parameters and then redirecting the victim to the related standalone confirmation dialog could use this to retrieve or modify sensitive configuration settings, interrupt prints or otherwise interact with the OctoPrint instance in a malicious way. The above mentioned specific vulnerabilities of the login dialog and the standalone application key confirmation dialog have been patched in the bugfix release 1.10.3 by individual escaping of the detected locations. A global change throughout all of OctoPrint's templating system with the upcoming 1.11.0 release will handle this further, switching to globally enforced automatic escaping and thus reducing the attack surface in general. The latter will also improve the security of third party plugins. During a transition period, third party plugins will be able to opt into the automatic escaping. With OctoPrint 1.13.0, automatic escaping will be switched over to be enforced even for third party plugins, unless they explicitly opt-out.",
   id: "PYSEC-2024-201",
   modified: "2025-01-19T16:22:59.154645+00:00",
   published: "2024-11-05T19:15:05+00:00",
   references: [
      {
         type: "ADVISORY",
         url: "https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-xvxq-g8hw-fx4g",
      },
   ],
   severity: [
      {
         score: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
         type: "CVSS_V3",
      },
   ],
}

ghsa-xvxq-g8hw-fx4g

Vulnerability from github

Published

2024-11-05 15:05

Modified

2025-01-21 17:56

Severity ?

5.5 (Medium) - CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
5.1 (Medium) - CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Summary

OctoPrint Vulnerable to Reflected XSS in Jinja2 Templates

Details

Impact

OctoPrint versions up until and including 1.10.2 are vulnerable to reflected XSS vulnerabilities through its Jinja2 template system, as this is not configured to enforce automatic escaping. This affects, among other places, the login dialog and the standalone application key confirmation dialog.

An attacker who successfully talked a victim into clicking on or through a malicious third party app successfully redirected a victim to a specially crafted link could use this to retrieve or modify sensitive configuration settings, interrupt prints or otherwise interact with the OctoPrint instance in a malicious way.

Patches

The above mentioned specific vulnerabilities of the login dialog and the standalone application key confirmation dialog will be patched in the bugfix release 1.10.3 by individual escaping of the detected locations. A global change throughout all of OctoPrint's templating system with the upcoming 1.11.0 release will handle this further, switching to globally enforced automatic escaping and thus reducing the attack surface in general.

The latter will also improve the security of third party plugins. During a transition period, third party plugins will be able to opt into the automatic escaping. With OctoPrint 1.13.0, automatic escaping will be switched over to be enforced even for third party plugins, unless they explicitly opt-out.

Credits

This vulnerability was discovered and responsibly disclosed to OctoPrint by Jacopo Tediosi.

Show details on source website

JSON

To clipboard

{
   affected: [
      {
         database_specific: {
            last_known_affected_version_range: "<= 1.10.2",
         },
         package: {
            ecosystem: "PyPI",
            name: "OctoPrint",
         },
         ranges: [
            {
               events: [
                  {
                     introduced: "0",
                  },
                  {
                     fixed: "1.10.3",
                  },
               ],
               type: "ECOSYSTEM",
            },
         ],
      },
   ],
   aliases: [
      "CVE-2024-49377",
   ],
   database_specific: {
      cwe_ids: [
         "CWE-79",
      ],
      github_reviewed: true,
      github_reviewed_at: "2024-11-05T15:05:55Z",
      nvd_published_at: "2024-11-05T19:15:05Z",
      severity: "MODERATE",
   },
   details: "### Impact\n\nOctoPrint versions up until and including 1.10.2 are vulnerable to reflected XSS vulnerabilities through its Jinja2 template system, as this is not configured to enforce automatic escaping. This affects, among other places, the login dialog and the standalone application key confirmation dialog. \n\nAn attacker who successfully talked a victim into clicking on or through a malicious third party app successfully redirected a victim to a specially crafted link could use this to retrieve or modify sensitive configuration settings, interrupt prints or otherwise interact with the OctoPrint instance in a malicious way.\n\n### Patches\n\nThe above mentioned specific vulnerabilities of the login dialog and the standalone application key confirmation dialog will be patched in the bugfix release 1.10.3 by individual escaping of the detected locations. A global change throughout all of OctoPrint's templating system with the upcoming 1.11.0 release will handle this further, switching to globally enforced automatic escaping and thus reducing the attack surface in general.\n\nThe latter will also improve the security of third party plugins. During a transition period, third party plugins will be able to opt into the automatic escaping. With OctoPrint 1.13.0, automatic escaping will be switched over to be enforced even for third party plugins, unless they explicitly opt-out.\n\n### Credits\n\nThis vulnerability was discovered and responsibly disclosed to OctoPrint by Jacopo Tediosi.\n",
   id: "GHSA-xvxq-g8hw-fx4g",
   modified: "2025-01-21T17:56:22Z",
   published: "2024-11-05T15:05:55Z",
   references: [
      {
         type: "WEB",
         url: "https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-xvxq-g8hw-fx4g",
      },
      {
         type: "ADVISORY",
         url: "https://nvd.nist.gov/vuln/detail/CVE-2024-49377",
      },
      {
         type: "WEB",
         url: "https://github.com/OctoPrint/OctoPrint/commit/b8a6b0a75202edac3bb142a8e4f9041a0b6825bf",
      },
      {
         type: "PACKAGE",
         url: "https://github.com/OctoPrint/OctoPrint",
      },
      {
         type: "WEB",
         url: "https://github.com/pypa/advisory-database/tree/main/vulns/octoprint/PYSEC-2024-201.yaml",
      },
   ],
   schema_version: "1.4.0",
   severity: [
      {
         score: "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
         type: "CVSS_V3",
      },
      {
         score: "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
         type: "CVSS_V4",
      },
   ],
   summary: "OctoPrint Vulnerable to Reflected XSS in Jinja2 Templates",
}

cve-2024-49377

Vulnerability from cvelistv5

Published

2024-11-05 18:20

Modified

2024-11-05 19:01

Severity ?

5.5 (Medium) - CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Summary

References

▼	URL	Tags
	https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-xvxq-g8hw-fx4g	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	OctoPrint	OctoPrint	Version: < 1.10.3

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-49377",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-05T19:01:15.891085Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-05T19:01:22.444Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "OctoPrint",
               vendor: "OctoPrint",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.10.3",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain reflected XSS vulnerabilities in the login dialog and the standalone application key confirmation dialog.  An attacker who successfully talked a victim into clicking on a specially crafted login link, or a malicious app running on a victim's computer triggering the application key workflow with specially crafted parameters and then redirecting the victim to the related standalone confirmation dialog could use this to retrieve or modify sensitive configuration settings, interrupt prints or otherwise interact with the OctoPrint instance in a malicious way. The above mentioned specific vulnerabilities of the login dialog and the standalone application key confirmation dialog have been patched in the bugfix release 1.10.3 by individual escaping of the detected locations. A global change throughout all of OctoPrint's templating system with the upcoming 1.11.0 release will handle this further, switching to globally enforced automatic escaping and thus reducing the attack surface in general. The latter will also improve the security of third party plugins. During a transition period, third party plugins will be able to opt into the automatic escaping. With OctoPrint 1.13.0, automatic escaping will be switched over to be enforced even for third party plugins, unless they explicitly opt-out.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "ADJACENT_NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-79",
                     description: "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-80",
                     description: "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-05T18:20:27.173Z",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               name: "https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-xvxq-g8hw-fx4g",
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-xvxq-g8hw-fx4g",
            },
         ],
         source: {
            advisory: "GHSA-xvxq-g8hw-fx4g",
            discovery: "UNKNOWN",
         },
         title: "Jinja2 Templates are vulnerable to XSS attacks due to their configuration in OctoPrint",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2024-49377",
      datePublished: "2024-11-05T18:20:27.173Z",
      dateReserved: "2024-10-14T13:56:34.812Z",
      dateUpdated: "2024-11-05T19:01:22.444Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

pysec-2024-201

Vulnerability from pysec

ghsa-xvxq-g8hw-fx4g

Vulnerability from github

Impact

Patches

Credits

cve-2024-49377

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature