GHSA-p623-mxf7-qxjm: OctoPrint: Stored XSS via saved connection parameters
OctoPrint provides a web interface for controlling consumer 3D printers. From 2.0.0rc1 until 2.0.0rc7, an authenticated user can supply a crafted default port or baudrate through a connect request to the bundled Serial Connector plugin. OctoPrint persists these values in printerConnection.preferred.parameters.port or printerConnection.preferred.parameters.baudrate and renders them as HTML when another user views the saved connection parameters, allowing script execution in that user's browser and actions within the user's OctoPrint access. This issue is fixed in version 2.0.0rc7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OctoPrintto a version that resolves this vulnerability.Fixed in 2.0.0rc7
Event History
Frequently Asked Questions
Who is exposed to this issue?
OctoPrint instances running versions from 2.0.0rc1 through 2.0.0rc7 are affected. Exploitation requires an authenticated user who can submit a connect request to the bundled Serial Connector plugin, and a second user who views the saved connection parameters.
What access does an attacker need?
The attacker needs authenticated access to OctoPrint and must be able to supply a crafted default port or baudrate value in a connect request. User interaction is also required because another user must view the persisted connection parameters.
What is the impact if exploitation succeeds?
The crafted value can execute script in the viewing user's browser. The script can perform actions using that user's OctoPrint access.
How can I determine whether my instance may be affected?
Check whether the instance is running a release in the stated affected range and inspect saved printer connection settings for unexpected values in printerConnection.preferred.parameters.port or printerConnection.preferred.parameters.baudrate. These are the persisted fields used by the issue.
What is the remediation?
Upgrade to the fixed 2.0.0rc7 release. If upgrading is not immediately possible, limit authenticated access to trusted users and avoid viewing saved connection parameters that may have been supplied by untrusted users.