Skip to main content

Improper Neutralization of Special Elements Used in a Template Engine

CVE-2023-41047

Medium
6.5/10

Summary

OctoPrint is a web interface for 3D printers. OctoPrint versions prior to 1.9.3 contain a vulnerability that allows malicious admins to configure a specially crafted "GCODE" script that will allow code execution during the rendering of that script. An attacker might use this to extract data managed by OctoPrint, or manipulate data managed by OctoPrint, as well as execute arbitrary commands with the rights of the OctoPrint process on the server system. Administrators of OctoPrint instances are advised to make sure they can trust all other administrators on their instance and to also not blindly configure arbitrary "GCODE" scripts found online or provided to them by third parties.

  • LOW
  • LOCAL
  • HIGH
  • UNCHANGED
  • REQUIRED
  • HIGH
  • HIGH
  • HIGH

CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine

The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

References

Advisory Timeline

  • Published