Executive brief
OctoPrint is a web-based 3D printer controller used by makers and manufacturers to monitor and manage 3D printing operations. A flaw in version 1.8.0–1.8.2 allows read-only users to gain administrative plugin management capabilities (enable/disable plugins, uninstall plugins, delete settings) that should be restricted to administrators, potentially allowing unauthorized control over printer behavior and software.
Technical details
A privilege escalation vulnerability exists in OctoPrint's PluginManager due to an incorrect permission role assignment introduced in version 1.8.0. The LIST permission for plugins was incorrectly assigned the "manage" role instead of the "list" role, granting read-only and user group members the same rights as administrators. This allows a read-only user to enable/disable plugins, uninstall plugins, list installed plugins with full details, retrieve plugin notices, and delete orphaned plugin settings. The vulnerability is triggered on the network without authentication bypass—only requiring an existing read-only account. The issue was patched in version 1.8.3 by correcting the role assignment from "manage" to "list".
Affected products
- OctoPrint OctoPrint before 1.8.3
Timeline
- 2022-09-22: disclosed
- 2022-09-23: patched: Version 1.8.3 released with fix