CVE-2022-2930: Unverified Password Change (CWE-620)
value: Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3.
CWE description: When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
CVSS v3 base score: 7.8
Published: 2022-08-22T12:15Z
Repository: https://github.com/octoprint/octoprint
Language: JavaScript
Files changed: docs/api/access.rst, src/octoprint/server/api/access.py, src/octoprint/static/js/app/client/access.js, src/octoprint/static/js/app/viewmodels/access.js, src/octoprint/static/js/app/viewmodels/usersettings.js, src/octoprint/templates/dialogs/usersettings/access.jinja2
Commit date: 2022-08-22 12:17:49 +0200
Commit message: 🔒️ Require the current password for changing it

Admins may still change existing user account passwords without
having to enter the current one, however the regular user oriented
password change dialog has been adjusted to require entry of the
current password. The API has been locked down accordingly and
the password change endpoint has seen a small change due to that,
please refer to the updated documentation.

Diff: diff --git a/docs/api/access.rst b/docs/api/access.rst
index 9379a27cb7..8380bc9362 100644
--- a/docs/api/access.rst
+++ b/docs/api/access.rst
@@ -236,20 +236,26 @@ Change a user's password
 
 .. http:put:: /api/access/users/(string:username)/password
 
    Changes the password of a user.
 
-   Expects a JSON object with a single property ``password`` as request body.
+   Expects a JSON object with a property ``password`` containing the new password as
+   request body. Without the ``SETTINGS`` permission, an additional property ``current``
+   is also required to be set on the request body, containing the user's current password.
 
-   Requires the ``SETTINGS`` permission or to be logged in as the user.
+   Requires the ``SETTINGS`` permission or to be logged in as the user. Note that ``current``
+   will be evaluated even in presence of the ``SETTINGS`` permission, if set.
 
    :param username: Name of the user to change the password for
    :json password:  The new password to set
+   :json current:   The current password
    :status 200:     No error
-   :status 400:     If the request doesn't contain a ``password`` property or the request
+   :status 400:     If the request doesn't contain a ``password`` property, doesn't
+                    contain a ``current`` property even though required, or the request
                     is otherwise invalid
-   :status 403:     No admin rights and not logged in as the user
+   :status 403:     No admin rights, not logged in as the user or a current password
+                    mismatch
    :status 404:     The user is unknown
 
 .. _sec-api-access-users-settings-get:
 
 Get a user's settings
diff --git a/src/octoprint/server/api/access.py b/src/octoprint/server/api/access.py
index a41badce95..28293dd844 100644
--- a/src/octoprint/server/api/access.py
+++ b/src/octoprint/server/api/access.py
@@ -239,22 +239,32 @@ def change_password_for_user(username):
         return jsonify(SUCCESS)
 
     if (
         current_user is not None
         and not current_user.is_anonymous
-        and (current_user.get_name() == username or current_user.is_admin)
+        and (
+            current_user.get_name() == username
+            or current_user.has_permission(Permissions.SETTINGS)
+        )
     ):
         if "application/json" not in request.headers["Content-Type"]:
             abort(400, description="Expected content-type JSON")
 
         data = request.get_json()
 
         if data is None:
             abort(400, description="Malformed JSON body in request")
 
         if "password" not in data or not data["password"]:
-            abort(400, description="password is missing")
+            abort(400, description="new password is missing")
+
+        if not current_user.has_permission(Permissions.SETTINGS) or "current" in data:
+            if "current" not in data or not data["current"]:
+                abort(400, description="current password is missing")
+
+            if not userManager.check_password(username, data["current"]):
+                abort(403, description="Invalid current password")
 
         try:
             userManager.change_user_password(username, data["password"])
         except users.UnknownUser:
             abort(404)
diff --git a/src/octoprint/static/js/app/client/access.js b/src/octoprint/static/js/app/client/access.js
index 8476b4eeeb..2963cdbbc2 100644
--- a/src/octoprint/static/js/app/client/access.js
+++ b/src/octoprint/static/js/app/client/access.js
@@ -174,21 +174,30 @@
     };
 
     OctoPrintAccessUsersClient.prototype.changePassword = function (
         name,
         password,
+        oldpw,
         opts
     ) {
+        if (_.isObject(oldpw)) {
+            opts = oldpw;
+            oldpw = undefined;
+        }
+
         if (!name || !password) {
             throw new OctoPrintClient.InvalidArgumentError(
-                "user name and password must be set"
+                "user name and new password must be set"
             );
         }
 
         var data = {
             password: password
         };
+        if (oldpw) {
+            data["current"] = oldpw;
+        }
         return this.base.putJson(this.url(name, "password"), data, opts);
     };
 
     OctoPrintAccessUsersClient.prototype.generateApiKey = function (name, opts) {
         if (!name) {
diff --git a/src/octoprint/static/js/app/viewmodels/access.js b/src/octoprint/static/js/app/viewmodels/access.js
index 0c9c842097..f773f1f36a 100644
--- a/src/octoprint/static/js/app/viewmodels/access.js
+++ b/src/octoprint/static/js/app/viewmodels/access.js
@@ -38,14 +38,16 @@ $(function () {
             self.editor = {
                 name: ko.observable(undefined),
                 groups: ko.observableArray([]),
                 permissions: ko.observableArray([]),
                 password: ko.observable(undefined),
+                currentPassword: ko.observable(undefined),
                 repeatedPassword: ko.observable(undefined),
                 passwordMismatch: ko.pureComputed(function () {
                     return self.editor.password() !== self.editor.repeatedPassword();
                 }),
+                currentPasswordMismatch: ko.observable(false),
                 apikey: ko.observable(undefined),
                 active: ko.observable(undefined),
                 permissionSelectable: function (permission) {
                     return true;
                 },
@@ -126,10 +128,15 @@ $(function () {
                     self.editor.new(false);
                     self.editor.confirm = self.confirmEditUser;
                 }
                 self.editor.password(undefined);
                 self.editor.repeatedPassword(undefined);
+                self.editor.currentPassword(undefined);
+                self.editor.currentPasswordMismatch(false);
+            });
+            self.editor.currentPassword.subscribe(function () {
+                self.editor.currentPasswordMismatch(false);
             });
 
             self.requestData = function () {
                 if (!CONFIG_ACCESS_CONTROL) return;
                 if (!access.loginState.hasPermissionKo(access.permissions.ADMIN)) return;
@@ -242,17 +249,25 @@ $(function () {
             };
 
             self.confirmChangePassword = function () {
                 if (!CONFIG_ACCESS_CONTROL) return;
 
-                self.updatePassword(self.currentUser().name, self.editor.password()).done(
-                    function () {
+                self.updatePassword(
+                    self.currentUser().name,
+                    self.editor.password(),
+                    self.editor.currentPassword()
+                )
+                    .done(function () {
                         // close dialog
                         self.currentUser(undefined);
                         self.changePasswordDialog.modal("hide");
-                    }
-                );
+                    })
+                    .fail(function (xhr) {
+                        if (xhr.status === 403) {
+                            self.currentPasswordMismatch(true);
+                        }
+                    });
             };
 
             self.confirmGenerateApikey = function () {
                 if (!CONFIG_ACCESS_CONTROL) return;
 
@@ -347,12 +362,12 @@ $(function () {
                         user.groups
                     )
                     .done(self.fromResponse);
             };
 
-            self.updatePassword = function (username, password) {
-                return OctoPrint.access.users.changePassword(username, password);
+            self.updatePassword = function (username, password, current) {
+                return OctoPrint.access.users.changePassword(username, password, current);
             };
 
             self.generateApikey = function (username) {
                 return OctoPrint.access.users.generateApiKey(username).done(function () {
                     self.requestData();
diff --git a/src/octoprint/static/js/app/viewmodels/usersettings.js b/src/octoprint/static/js/app/viewmodels/usersettings.js
index 39828c365e..4588241b6d 100644
--- a/src/octoprint/static/js/app/viewmodels/usersettings.js
+++ b/src/octoprint/static/js/app/viewmodels/usersettings.js
@@ -23,17 +23,21 @@ $(function () {
         );
         self.locale_languages = _.keys(AVAILABLE_LOCALES);
 
         self.access_password = ko.observable(undefined);
         self.access_repeatedPassword = ko.observable(undefined);
+        self.access_currentPassword = ko.observable(undefined);
+        self.access_currentPasswordMismatch = ko.observable(false);
         self.access_apikey = ko.observable(undefined);
         self.interface_language = ko.observable(undefined);
 
         self.currentUser = ko.observable(undefined);
         self.currentUser.subscribe(function (newUser) {
             self.access_password(undefined);
             self.access_repeatedPassword(undefined);
+            self.access_currentPassword(undefined);
+            self.access_currentPasswordMismatch(false);
             self.access_apikey(undefined);
             self.interface_language("_default");
 
             if (newUser !== undefined) {
                 self.access_apikey(newUser.apikey);
@@ -43,10 +47,13 @@ $(function () {
                 ) {
                     self.interface_language(newUser.settings.interface.language);
                 }
             }
         });
+        self.access_currentPassword.subscribe(function () {
+            self.access_currentPasswordMismatch(false);
+        });
 
         self.passwordMismatch = ko.pureComputed(function () {
             return self.access_password() !== self.access_repeatedPassword();
         });
 
@@ -79,29 +86,42 @@ $(function () {
         self.save = function () {
             if (!CONFIG_ACCESS_CONTROL) return;
 
             self.userSettingsDialog.trigger("beforeSave");
 
-            if (self.access_password() && !self.passwordMismatch()) {
-                self.users.updatePassword(
-                    self.currentUser().name,
-                    self.access_password(),
-                    function () {}
-                );
+            function process() {
+                var settings = {
+                    interface: {
+                        language: self.interface_language()
+                    }
+                };
+                self.updateSettings(self.currentUser().name, settings).done(function () {
+                    // close dialog
+                    self.currentUser(undefined);
+                    self.userSettingsDialog.modal("hide");
+                    self.loginState.reloadUser();
+                });
             }
 
-            var settings = {
-                interface: {
-                    language: self.interface_language()
-                }
-            };
-            self.updateSettings(self.currentUser().name, settings).done(function () {
-                // close dialog
-                self.currentUser(undefined);
-                self.userSettingsDialog.modal("hide");
-                self.loginState.reloadUser();
-            });
+            if (self.access_password() && !self.passwordMismatch()) {
+                self.users
+                    .updatePassword(
+                        self.currentUser().name,
+                        self.access_password(),
+                        self.access_currentPassword()
+                    )
+                    .done(function () {
+                        process();
+                    })
+                    .fail(function (xhr) {
+                        if (xhr.status === 403) {
+                            self.access_currentPasswordMismatch(true);
+                        }
+                    });
+            } else {
+                process();
+            }
         };
 
         self.copyApikey = function () {
             copyToClipboard(self.access_apikey());
         };
diff --git a/src/octoprint/templates/dialogs/usersettings/access.jinja2 b/src/octoprint/templates/dialogs/usersettings/access.jinja2
index 50f4ba45f8..9cd750b6ff 100644
--- a/src/octoprint/templates/dialogs/usersettings/access.jinja2
+++ b/src/octoprint/templates/dialogs/usersettings/access.jinja2
@@ -2,10 +2,17 @@
     <fieldset>
         <legend>{{ _('Password') }}</legend>
         <p>
             {{ _('If you do not wish to change your password, just leave the following fields empty.') }}
         </p>
+        <div class="control-group" data-bind="css: {error: access_currentPasswordMismatch()}">
+            <label class="control-label" for="userSettings-access_currentPassword">{{ _('Current Password') }}</label>
+            <div class="controls">
+                <input type="password" class="input-block-level" id="userSettings-access_currentPassword" data-bind="value: access_currentPassword, valueUpdate: 'afterkeydown'" required>
+                <span class="help-inline" data-bind="visible: access_currentPasswordMismatch()">{{ _('Passwords do not match') }}</span>
+            </div>
+        </div>
         <div class="control-group">
             <label class="control-label" for="userSettings-access_password">{{ _('New Password') }}</label>
             <div class="controls">
                 <input type="password" class="input-block-level" id="userSettings-access_password" data-bind="value: access_password" required>
             </div>

Vulnerable code:    Expects a JSON object with a single property ``password`` as request body.
   Requires the ``SETTINGS`` permission or to be logged in as the user.
   :status 400:     If the request doesn't contain a ``password`` property or the request
   :status 403:     No admin rights and not logged in as the user
        and (current_user.get_name() == username or current_user.is_admin)
            abort(400, description="password is missing")
                "user name and password must be set"
                self.updatePassword(self.currentUser().name, self.editor.password()).done(
                    function () {
                    }
                );
            self.updatePassword = function (username, password) {
                return OctoPrint.access.users.changePassword(username, password);
            if (self.access_password() && !self.passwordMismatch()) {
                self.users.updatePassword(
                    self.currentUser().name,
                    self.access_password(),
                    function () {}
                );
            var settings = {
                interface: {
                    language: self.interface_language()
                }
            };
            self.updateSettings(self.currentUser().name, settings).done(function () {
                // close dialog
                self.currentUser(undefined);
                self.userSettingsDialog.modal("hide");
                self.loginState.reloadUser();
            });
Fixed code:    Expects a JSON object with a property ``password`` containing the new password as
   request body. Without the ``SETTINGS`` permission, an additional property ``current``
   is also required to be set on the request body, containing the user's current password.
   Requires the ``SETTINGS`` permission or to be logged in as the user. Note that ``current``
   will be evaluated even in presence of the ``SETTINGS`` permission, if set.
   :json current:   The current password
   :status 400:     If the request doesn't contain a ``password`` property, doesn't
                    contain a ``current`` property even though required, or the request
   :status 403:     No admin rights, not logged in as the user or a current password
                    mismatch
        and (
            current_user.get_name() == username
            or current_user.has_permission(Permissions.SETTINGS)
        )
            abort(400, description="new password is missing")

        if not current_user.has_permission(Permissions.SETTINGS) or "current" in data:
            if "current" not in data or not data["current"]:
                abort(400, description="current password is missing")

            if not userManager.check_password(username, data["current"]):
                abort(403, description="Invalid current password")
        oldpw,
        if (_.isObject(oldpw)) {
            opts = oldpw;
            oldpw = undefined;
        }

                "user name and new password must be set"
        if (oldpw) {
            data["current"] = oldpw;
        }
                currentPassword: ko.observable(undefined),
                currentPasswordMismatch: ko.observable(false),
                self.editor.currentPassword(undefined);
                self.editor.currentPasswordMismatch(false);
            });
            self.editor.currentPassword.subscribe(function () {
                self.editor.currentPasswordMismatch(false);
                self.updatePassword(
                    self.currentUser().name,
                    self.editor.password(),
                    self.editor.currentPassword()
                )
                    .done(function () {
                    })
                    .fail(function (xhr) {
                        if (xhr.status === 403) {
                            self.currentPasswordMismatch(true);
                        }
                    });
            self.updatePassword = function (username, password, current) {
                return OctoPrint.access.users.changePassword(username, password, current);
        self.access_currentPassword = ko.observable(undefined);
        self.access_currentPasswordMismatch = ko.observable(false);
            self.access_currentPassword(undefined);
            self.access_currentPasswordMismatch(false);
        self.access_currentPassword.subscribe(function () {
            self.access_currentPasswordMismatch(false);
        });
            function process() {
                var settings = {
                    interface: {
                        language: self.interface_language()
                    }
                };
                self.updateSettings(self.currentUser().name, settings).done(function () {
                    // close dialog
                    self.currentUser(undefined);
                    self.userSettingsDialog.modal("hide");
                    self.loginState.reloadUser();
                });
            if (self.access_password() && !self.passwordMismatch()) {
                self.users
                    .updatePassword(
                        self.currentUser().name,
                        self.access_password(),
                        self.access_currentPassword()
                    )
                    .done(function () {
                        process();
                    })
                    .fail(function (xhr) {
                        if (xhr.status === 403) {
                            self.access_currentPasswordMismatch(true);
                        }
                    });
            } else {
                process();
            }
        <div class="control-group" data-bind="css: {error: access_currentPasswordMismatch()}">
            <label class="control-label" for="userSettings-access_currentPassword">{{ _('Current Password') }}</label>
            <div class="controls">
                <input type="password" class="input-block-level" id="userSettings-access_currentPassword" data-bind="value: access_currentPassword, valueUpdate: 'afterkeydown'" required>
                <span class="help-inline" data-bind="visible: access_currentPasswordMismatch()">{{ _('Passwords do not match') }}</span>
            </div>
        </div>