CVE-2021-32560

Vulnerability

The Logging subsystem in OctoPrint versions prior to 1.6.0 has incorrect access control because it attempts to manage files that are not *.log files [1][2]. This means the subsystem does not properly restrict file operations to only log files, potentially exposing other files to unauthorized management actions.

Exploitation

An attacker with network access to the OctoPrint web interface and valid credentials could exploit this by requesting operations on arbitrary files that are not log files. The exact steps are not detailed in the references, but the vulnerability lies in the lack of file extension validation.

Impact

Successful exploitation could allow an attacker to read, download, or otherwise manage files outside the intended log directory, leading to information disclosure or unauthorized file access. The impact depends on the permissions of the OctoPrint process.

Mitigation

The vulnerability is fixed in OctoPrint version 1.6.0, released on April 27, 2021 [1][2]. Users should upgrade to 1.6.0 or later. No workarounds are mentioned in the available references.