CVE-2024-23637: OctoPrint Unverified Password Change via Access Control Settings
Impact
OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password.
An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance.
Patches
The vulnerability will be patched in version 1.10.0.
Workarounds
OctoPrint administrators are strongly advised to thoroughly vet who has admin access to their installation.
Credits
This vulnerability was discovered and responsibly disclosed to OctoPrint by Timothy "TK" Ruppert.
Other sources
OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance. The vulnerability will be patched in version 1.10.0.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/OctoPrintto a version that resolves this vulnerability.Fixed in 1.10.0rc1 - Upgrade
Upgrade
OctoPrintto a version that resolves this vulnerability.Fixed in 1.10.0 - Configuration
Vet and strictly control who is granted admin access to the OctoPrint instance, since a malicious admin could lock out real admins by changing other admin passwords.
OctoPrint Admin access control = Thoroughly vet who has admin access
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23637?
CVE-2024-23637 has a high severity rating due to the potential for unauthorized password changes by malicious admins.
How do I fix CVE-2024-23637?
To fix CVE-2024-23637, upgrade OctoPrint to version 1.10.0rc1 or later.
Who is affected by CVE-2024-23637?
CVE-2024-23637 affects all versions of OctoPrint up to and including 1.9.3.
What is the impact of CVE-2024-23637?
The impact of CVE-2024-23637 allows malicious admins to change other admin passwords without needing to know the current password.
Can CVE-2024-23637 be exploited remotely?
CVE-2024-23637 can be exploited by attackers who have gained access to an admin account.