OctoPrint 1.0.0 API Key settings.py getSettings information disclosure

Summaryinfo

A vulnerability labeled as problematic has been found in OctoPrint 1.0.0. Affected is the function getSettings of the file src/octoprint/server/ajax/settings.py of the component API Key Handler. Such manipulation leads to information disclosure. This vulnerability is listed as CVE-2013-10077. The attack may be performed from remote. In addition, an exploit is available. The affected component should be upgraded. Affected is a 2013 release where access control was not yet implemented and the endpoint was part of first-run setup). The API key has been admin-gated since 1.2.0 and GET /api/settings is protected by Permissions.SETTINGS_READ plus reauthentication in all current releases.

Detailsinfo

A vulnerability was found in OctoPrint 1.0.0 and classified as problematic. Affected by this issue is the function getSettings of the file src/octoprint/server/ajax/settings.py of the component API Key Handler. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality.

This vulnerability is handled as CVE-2013-10077. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details as well as a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1592.

It is declared as proof-of-concept. Affected is a 2013 release where access control was not yet implemented and the endpoint was part of first-run setup). The API key has been admin-gated since 1.2.0 and GET /api/settings is protected by Permissions.SETTINGS_READ plus reauthentication in all current releases.

Upgrading to version 1.1.0-rc1 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch eccc9d6fbde0c46cdd6e255fd5ce9a30077ba954 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• OctoPrint

Version

• 1.0.0

License

• open-source

Website

• Product: https://github.com/OctoPrint/OctoPrint/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #994544: OctoPrint 1.0.0 Unauthenticated Full Settings Disclosure (CWE-200, CVSS 7.5) (by github.com)

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion