CVE-2013-10077: OctoPrint API Key settings.py getSettings information disclosure
A weakness has been identified in OctoPrint 1.0.0. This impacts the function getSettings of the file src/octoprint/server/ajax/settings.py of the component API Key Handler. This manipulation causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.1.0-rc1 will fix this issue. Patch name: eccc9d6fbde0c46cdd6e255fd5ce9a30077ba954. You should upgrade the affected component. Affected is a 2013 release where access control was not yet implemented and the endpoint was part of first-run setup). The API key has been admin-gated since 1.2.0 and GET /api/settings is protected by Permissions.SETTINGSREAD plus reauthentication in all current releases.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OctoPrintto a version that resolves this vulnerability.Fixed in 1.1.0-rc1Patch eccc9d6fbde0c46cdd6e255fd5ce9a30077ba954
Event History
Frequently Asked Questions
Which deployments are exposed?
OctoPrint 1.0.0 is affected. The issue applies to a 2013-era release in which access control had not yet been implemented and the endpoint was part of first-run setup.
Does exploitation require authentication or local access?
No. The attack can be performed remotely, and the supplied severity vector indicates no privileges or user interaction are required.
What information can be disclosed?
The vulnerable API Key Handler's getSettings function can disclose information, including the API key context described for this issue. The provided data does not identify any additional specific settings or data types.
What should be done if the affected version is in use?
Upgrade OctoPrint to version 1.1.0-rc1 or later; the identified fix is patch eccc9d6fbde0c46cdd6e255fd5ce9a30077ba954. Current releases protect GET /api/settings with SETTINGS_READ permission and reauthentication, and API-key access has been admin-gated since 1.2.0.