CVE-2024-28237

OctoPrint XSS via the "Snapshot Test" feature in Classic Webcam plugin settings

Severity Score

4.0

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track*

*SSVC

Descriptions

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to configure or talk a victim with administrator rights into configuring a webcam snapshot URL which when tested through the "Test" button included in the web interface will execute JavaScript code in the victims browser when attempting to render the snapshot image. An attacker who successfully talked a victim with admin rights into performing a snapshot test with such a crafted URL could use this to retrieve or modify sensitive configuration settings, interrupt prints or otherwise interact with the OctoPrint instance in a malicious way. The vulnerability is patched in version 1.10.0rc3. OctoPrint administrators are strongly advised to thoroughly vet who has admin access to their installation and what settings they modify based on instructions by strangers.

OctoPrint proporciona una interfaz web para controlar impresoras 3D de consumo. Las versiones de OctoPrint hasta la 1.9.3 incluida contienen una vulnerabilidad que permite a administradores maliciosos configurar o convencer a una víctima con derechos de administrador para que configure una URL de instantánea de cámara web que, cuando se prueba a través del botón "Probar" incluido en la interfaz web, ejecutará código JavaScript en el navegador de la víctima al intentar renderizar la imagen instantánea. Un atacante que consiguiera convencer a una víctima con derechos de administrador para que realizara una prueba instantánea con una URL tan manipulada podría utilizarla para recuperar o modificar ajustes de configuración confidenciales, interrumpir impresiones o interactuar de otro modo con la instancia de OctoPrint de forma maliciosa. La vulnerabilidad está parcheada en la versión 1.10.0rc3. Se recomienda encarecidamente a los administradores de OctoPrint que investiguen minuciosamente quién tiene acceso de administrador a su instalación y qué configuraciones modifican según instrucciones de extraños.

*Credits: N/A

CVSS Scores

GitHubv3.1 4.0

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

* Common Vulnerability Scoring System

SSVC

Decision:Track*

Exploitation

Poc

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-03-07 CVE Reserved
2024-03-18 CVE Published
2024-03-19 EPSS Updated
2024-08-02 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (2)

URL	Tag	Source
https://github.com/OctoPrint/OctoPrint/commit/779894c1bc6478332d14bc9ed1006df1354eb517	X_refsource_misc
https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-x7mf-wrh9-r76c	X_refsource_confirm

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
OctoPrint Search vendor "OctoPrint"		OctoPrint Search vendor "OctoPrint" for product "OctoPrint"				<= 1.9.3 Search vendor "OctoPrint" for product "OctoPrint" and version " <= 1.9.3"		en		Affected