Summary
OctoPrint-PrusaSlicerThumbnails <= 1.1.0 allows downloading OctoPrint print file preview images without authentication.
Details
The preview images are served by the plugin through the following implementation of the OctoPrint Mixin octoprint.server.http.routes:
|
def route_hook(self, server_routes, *args, **kwargs): |
|
from octoprint.server.util.tornado import LargeResponseHandler, path_validation_factory |
|
from octoprint.util import is_hidden_path |
|
thumbnail_root_path = self._file_manager.path_on_disk("local", "") if self._settings.get_boolean(["use_uploads_folder"]) else self.get_plugin_data_folder() |
|
return [ |
|
(r"thumbnail/(.*)", LargeResponseHandler, |
|
{'path': thumbnail_root_path, 'as_attachment': False, 'path_validation': path_validation_factory( |
|
lambda path: not is_hidden_path(path), status_code=404)}) |
|
] |
As visible, the
/thumbnail/(.*) route does not perform any authentication check.
PoC
- Upload a valid
.gcode file (e.g., a.gcode) to OctoPrint and wait for the plugin to generate the thumbnail.
- Retrieve the thumbnail without authentication - e.g., open the image in an incognito/private browser tab or download it with
curl without sending any session cookies.
Screenshot:
Impact
An unauthenticated attacker can download thumbnail images of print files uploaded to OctoPrint if the filename is known.
jacopotediosi Reporter
Summary
OctoPrint-PrusaSlicerThumbnails <= 1.1.0 allows downloading OctoPrint print file preview images without authentication.
Details
The preview images are served by the plugin through the following implementation of the OctoPrint Mixin
octoprint.server.http.routes:OctoPrint-PrusaSlicerThumbnails/octoprint_prusaslicerthumbnails/__init__.py
Lines 347 to 355 in 0a01435
As visible, the
/thumbnail/(.*)route does not perform any authentication check.PoC
.gcodefile (e.g.,a.gcode) to OctoPrint and wait for the plugin to generate the thumbnail.curlwithout sending any session cookies.Screenshot:
Impact
An unauthenticated attacker can download thumbnail images of print files uploaded to OctoPrint if the filename is known.