CVE-2024-49377

Credits

This vulnerability was discovered and responsibly disclosed to OctoPrint by Jacopo Tediosi.

OctoPrint versions up until and including 1.10.2 are vulnerable to reflected XSS vulnerabilities through its Jinja2 template system, as this is not configured to enforce automatic escaping. This affects, among other places, the login dialog and the standalone application key confirmation dialog.

An attacker who successfully talked a victim into clicking on or through a malicious third party app successfully redirected a victim to a specially crafted link could use this to retrieve or modify sensitive configuration settings, interrupt prints or otherwise interact with the OctoPrint instance in a malicious way.

Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.

CVE-2024-49377 has a CVSS score of 5.5 (Medium). The vector is reachable from an adjacent network, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.10.3); upgrading removes the vulnerable code path.

Kodem intelligence

The above mentioned specific vulnerabilities of the login dialog and the standalone application key confirmation dialog will be patched in the bugfix release 1.10.3 by individual escaping of the detected locations. A global change throughout all of OctoPrint's templating system with the upcoming 1.11.0 release will handle this further, switching to globally enforced automatic escaping and thus reducing the attack surface in general.

The latter will also improve the security of third party plugins. During a transition period, third party plugins will be able to opt into the automatic escaping. With OctoPrint 1.13.0, automatic escaping will be switched over to be enforced even for third party plugins, unless they explicitly opt-out.

1. What is CVE-2024-49377? CVE-2024-49377 is a medium-severity cross-site scripting (XSS) vulnerability in OctoPrint (pip), affecting versions <= 1.10.2. It is fixed in 1.10.3. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
2. How severe is CVE-2024-49377? CVE-2024-49377 has a CVSS score of 5.5 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of OctoPrint are affected by CVE-2024-49377? OctoPrint (pip) versions <= 1.10.2 is affected.
4. Is there a fix for CVE-2024-49377? Yes. CVE-2024-49377 is fixed in 1.10.3. Upgrade to this version or later.
5. Is CVE-2024-49377 exploitable, and should I be worried? Whether CVE-2024-49377 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2024-49377 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2024-49377? Upgrade OctoPrint to 1.10.3 or later.