CVE-2024-49377 Overview
OctoPrint is a widely deployed web interface for controlling consumer 3D printers. CVE-2024-49377 identifies reflected cross-site scripting (XSS) vulnerabilities in the login dialog and the standalone application key confirmation dialog of OctoPrint versions up to and including 1.10.2. An attacker who convinces a victim to click a crafted login link, or who triggers the application key workflow from a malicious local application and redirects the victim to the confirmation dialog, can execute script in the victim's browser session. The injected script can read or modify configuration settings, interrupt active print jobs, and interact with the OctoPrint instance under the victim's authenticated context.
Critical Impact
Successful exploitation allows attackers to hijack authenticated OctoPrint sessions, tamper with printer configuration, and disrupt ongoing prints through crafted links or malicious local applications.
Affected Products
- OctoPrint versions up to and including 1.10.2
- Fixed in OctoPrint 1.10.3
- Additional hardening scheduled for OctoPrint 1.11.0 and 1.13.0
Discovery Timeline
- 2024-11-05 - CVE-2024-49377 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-49377
Vulnerability Analysis
CVE-2024-49377 is a reflected cross-site scripting flaw classified under [CWE-79]. Two distinct sinks are affected: the login dialog and the standalone application key confirmation dialog. Both templates rendered user-controlled parameters without applying context-appropriate escaping, allowing attacker-supplied HTML and JavaScript to execute in the victim's browser.
The vulnerability requires user interaction. An attacker must deliver a crafted URL to the victim or run a malicious application on the victim's host that initiates the OctoPrint application key workflow and redirects to the confirmation dialog with malicious parameters. Once the payload executes, it inherits the origin and session of the OctoPrint web interface.
Because OctoPrint controls physical hardware, the impact extends beyond typical web application risk. Attackers can invoke print operations, alter thermal or motion configuration, or exfiltrate API keys used by connected slicers and plugins.
Root Cause
The root cause is missing output escaping in specific Jinja templates used by OctoPrint's authentication and application key workflows. Reflected parameters were placed directly into HTML contexts without sanitization, permitting script injection.
Attack Vector
Exploitation occurs over the network and requires user interaction. Attack delivery relies on social engineering through a malicious link, or on a locally running malicious application abusing the application key exchange to steer the browser to a poisoned confirmation URL. No authentication is required to craft the payload, though the victim must be interacting with the OctoPrint instance for maximum impact.
No verified public proof-of-concept code is available for CVE-2024-49377. Refer to the OctoPrint GitHub Security Advisory GHSA-xvxq-g8hw-fx4g for maintainer-provided technical detail.
Detection Methods for CVE-2024-49377
Indicators of Compromise
- Web server access logs containing OctoPrint login or /plugin/appkeys/auth/ requests with URL parameters that include HTML tags, javascript: URIs, or encoded <script> fragments.
- Unexpected changes to OctoPrint configuration files, API keys, or user records that correlate with recent user browser sessions.
- Print jobs that were paused, cancelled, or modified without matching operator actions in the local audit log.
Detection Strategies
- Inspect HTTP request query strings and referrers reaching OctoPrint endpoints for reflected XSS payload patterns.
- Baseline the OctoPrint configuration and application key store, then alert on out-of-band modifications.
- Correlate outbound browser telemetry from operator workstations with visits to untrusted URLs that redirect to the OctoPrint web UI.
Monitoring Recommendations
- Enable and forward OctoPrint access and application logs to a centralized log platform for query and retention.
- Monitor endpoints running slicer software or OctoPrint companion apps for unexpected processes invoking the application key workflow.
- Track the installed OctoPrint version across the fleet and alert when instances remain on 1.10.2 or earlier.
How to Mitigate CVE-2024-49377
Immediate Actions Required
- Upgrade all OctoPrint instances to version 1.10.3 or later, which applies targeted escaping to the affected login and application key dialogs.
- Rotate OctoPrint user credentials and revoke existing application keys if exploitation is suspected.
- Restrict OctoPrint web interface exposure to trusted networks and require VPN or reverse-proxy authentication for remote access.
Patch Information
The maintainers patched the specific reflected XSS sinks in OctoPrint 1.10.3 by escaping the affected locations individually. OctoPrint 1.11.0 introduces globally enforced automatic escaping across the templating system, and OctoPrint 1.13.0 will enforce automatic escaping for third-party plugins unless they explicitly opt out. See the OctoPrint GitHub Security Advisory for full remediation details.
Workarounds
- Instruct operators to avoid clicking OctoPrint login or application key confirmation links received from untrusted sources.
- Place OctoPrint behind a reverse proxy that filters requests containing suspicious script patterns in query parameters.
- Disable or restrict the application key plugin workflow if it is not required in the environment.
# Upgrade OctoPrint to the patched release using pip
pip install --upgrade "OctoPrint>=1.10.3"
# Verify the installed version
octoprint --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
