SB2024013170 - Multiple vulnerabilities in OctoPrint

Description

This security bulletin contains information about 2 vulnerabilities.

1) Cross-site scripting (CVE-ID: CVE-2024-28237)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 2.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows an administrator to execute JavaScript in another administrator's browser and access or modify sensitive OctoPrint settings.

The vulnerability exists due to improper neutralization of a malicious snapshot response content type in the Classic Webcam plugin when its Snapshot Test feature renders an image. An administrator can configure a crafted snapshot URL and induce the victim administrator to click Test, triggering the injected script.

2) Unverified Password Change (CVE-ID: CVE-2024-23637)

CWE-ID: CWE-620 - Unverified Password Change

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an administrator to change passwords for other administrator accounts in OctoPrint without reauthentication.

The vulnerability exists due to missing verification of the acting administrator's password when password changes are submitted through the access control settings. An administrator can use a hijacked administrator account to reset legitimate administrators' passwords and lock them out of their OctoPrint instance.

Remediation

Install update from vendor's website.

References

• https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-x7mf-wrh9-r76c
• https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-5626-pw9c-hmjr