CVE-2022-1430
📋 TL;DR
This DOM-based XSS vulnerability in OctoPrint allows attackers to inject malicious scripts that execute in users' browsers when viewing manipulated content. It affects all OctoPrint instances prior to version 1.8.0. Attackers could steal session cookies, redirect users, or perform actions on their behalf.
💻 Affected Systems
- OctoPrint
📦 What is this software?
Octoprint by Octoprint
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of OctoPrint instance allowing attacker to control 3D printers, steal credentials, or pivot to internal networks.
Likely Case
Session hijacking leading to unauthorized access to OctoPrint interface and printer control.
If Mitigated
Limited impact with proper network segmentation and browser security controls.
🎯 Exploit Status
Exploitation requires user interaction (clicking malicious link) but payloads are publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.8.0 and later
Vendor Advisory: https://github.com/octoprint/octoprint/commit/8087528e4a7ddd15c7d95ff662deb5ef7de90045
Restart Required: Yes
Instructions:
1. Backup current OctoPrint configuration. 2. Update via OctoPrint web interface: Settings → Software Update → Check for updates. 3. Install version 1.8.0 or later. 4. Restart OctoPrint service.
🔧 Temporary Workarounds
Content Security Policy (CSP)
allImplement strict CSP headers to prevent script execution from untrusted sources.
Add to web server config: Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval';
Network Isolation
linuxRestrict OctoPrint access to trusted networks only.
iptables -A INPUT -p tcp --dport 5000 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 5000 -j DROP
🧯 If You Can't Patch
- Implement reverse proxy with WAF rules to filter malicious requests
- Disable remote access and only allow local network connections
🔍 How to Verify
Check if Vulnerable:
Check OctoPrint version in web interface: Settings → About → Version. If version is below 1.8.0, system is vulnerable.Check Version:
grep __version__ /path/to/octoprint/octoprint/__init__.pyVerify Fix Applied:
Verify version is 1.8.0 or higher and test XSS payloads no longer execute.📡 Detection & Monitoring
Log Indicators:
- Unusual JavaScript execution in browser console
- Suspicious URL parameters containing script tags
Network Indicators:
- HTTP requests with script payloads in query parameters
- Unusual outbound connections from OctoPrint server
SIEM Query:
source="octoprint.log" AND ("script" OR "javascript" OR "onerror" OR "onload")🔗 References
- https://github.com/octoprint/octoprint/commit/8087528e4a7ddd15c7d95ff662deb5ef7de90045
- https://huntr.dev/bounties/0cd30d71-1e32-4a0b-b4c3-faaa1907b541
- https://github.com/octoprint/octoprint/commit/8087528e4a7ddd15c7d95ff662deb5ef7de90045
- https://huntr.dev/bounties/0cd30d71-1e32-4a0b-b4c3-faaa1907b541
