PYSEC-2023-195

    Dashboard / Vulnerabilities / PYSEC-2023-195

    PYSEC-2023-195

    Published: 9 Oct 2023Last Modified: 8 Nov 2023

    Summary:

    Details: OctoPrint is a web interface for 3D printers. OctoPrint versions up until and including 1.9.2 contain a vulnerability that allows malicious admins to configure a specially crafted GCODE script that will allow code execution during rendering of that script. An attacker might use this to extract data managed by OctoPrint, or manipulate data managed by OctoPrint, as well as execute arbitrary commands with the rights of the OctoPrint process on the server system. OctoPrint versions from 1.9.3 onward have been patched. Administrators of OctoPrint instances are advised to make sure they can trust all other administrators on their instance and to also not blindly configure arbitrary GCODE scripts found online or provided to them by third parties.

    References: https://github.com/OctoPrint/OctoPrint/commit/d0072cff894509c77e243d6562245ad3079e17db, https://github.com/OctoPrint/OctoPrint/releases/tag/1.9.3, https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-fwfg-vprh-97ph

    Affected packages

    Package

    Name: octoprint

    Purl: pkg:pypi/octoprint

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -d0072cff894509c77e243d6562245ad3079e17db

    Affected versions

    1.3.11
    1.3.12
    1.3.12rc1
    1.3.12rc3

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    PYSEC-2023-195 | CVE-DB