Unauthenticated Attackers Can Bypass Authentication in OctoPrint Versions Up to 1.10.0

CVE-2024-32977

What is CVE-2024-32977?

OctoPrint, a popular web interface for managing consumer 3D printers, has a vulnerability that allows unauthenticated access under specific configurations. When the autologinLocal option is enabled in the config.yaml file, attackers can spoof their IP address using the X-Forwarded-For header and gain unauthorized access, even from non-local networks. This issue affects all versions of OctoPrint up to and including 1.10.0, posing a significant security risk for instances exposed to the internet. Users are advised to disable autologin or restrict access to trusted networks until the patch is applied, available in version 1.10.1. For more details and guidance on mitigating this vulnerability, please refer to the official advisories.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References