| 标题 | OctoPrint 1.0.0 Unauthenticated Full Settings Disclosure (CWE-200, CVSS 7.5) |
|---|
| 描述 | Vulnerability Description
OctoPrint 1.0.0 is affected by an unauthenticated sensitive information disclosure vulnerability via the /ajax/settings interface. The endpoint lacks any authentication or permission check, allowing remote unauthenticated attackers to retrieve the complete system configuration, including API keys, absolute server paths, serial port credentials, webcam streaming addresses, and other critical data. The leaked API key can be used to control the 3D printer device completely.
Technical Details
In the file src/octoprint/server/ajax/settings.py, the GET /ajax/settings route function getSettings() does not implement the @restricted_access and @admin_permission.require protection decorators. In contrast, the corresponding POST /ajax/settings modification interface correctly enforces administrator authentication. Attackers can directly access the interface without any session or token to obtain all plaintext system configuration values, which contains high-risk credentials used for API interaction and device management.
Affected Version
OctoPrint 1.0.0
Problematic Code：
@ajax.route("/settings", methods=["GET"])
def getSettings():
s = settings()
return jsonify({
"api": {
"enabled": s.getBoolean(["api", "enabled"]),
"key": s.get(["api", "key"])
},
"folder": {
"uploads": s.getBaseFolder("uploads"),
"logs": s.getBaseFolder("logs")
},
"serial": s.get(["serial"]),
"webcam": s.get(["webcam"])
})
Trigger Conditions
1. Target service running OctoPrint 1.0.0. 2. Network access to port 5000. 3. No authentication, no user interaction required.
Proof of Concept：
curl http://target:5000/ajax/settings
Response contains plaintext API key, system absolute paths and device configuration.
Fix Recommendation
Add@restricted_access and @admin_permission.require(403) decorators to the GET settings endpoint. Filter sensitive credential fields for non-admin users and forbid unauthenticated access entirely. |
|---|
| 来源 | ⚠️ https://github.com/OctoPrint/OctoPrint |
|---|
| 用户 | Anonymous User |
|---|
| 提交 | 2026-09-22 18時58分 (1 月前) |
|---|
| 管理 | 2026-10-24 16時32分 (1 month later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 426128 [OctoPrint 1.0.0 API Key settings.py getSettings 信息公开] |
|---|
| 积分 | 20 |
|---|