Xerox DC260 EFI Fiery Controller Webtools 2.0 Arbitrary File Disclosure

2017-12-27T00:00:00
ID ZSL-2017-5447
Type zeroscience
Reporter Gjoko Krstic
Modified 2017-12-27T00:00:00

Description

Title: Xerox DC260 EFI Fiery Controller Webtools 2.0 Arbitrary File Disclosure
Advisory ID: ZSL-2017-5447
Type: Local/Remote
Impact: Exposure of System Information, Exposure of Sensitive Information
Risk: (4/5)
Release Date: 27.12.2017

Summary

Drive production profitability with Fiery servers and workflow products. See which Fiery digital front end is right for your current or future print engines and business needs. Manage all your printers from a single screen using this intuitive print job management interface.

Description

Input passed thru the 'file' GET parameter in 'forceSave.php' script is not properly sanitized before being used to read files. This can be exploited by an unauthenticated attacker to read arbitrary files on the affected system.

--------------------------------------------------------------------------------

` /wt3/js/save.js:

103: function parseSaveMessages() {
104: var urlNode = saveDocument.getElementsByTagName('url').item(0);
105: var url = urlNode.firstChild.data;
106: var forcedSaveUrl = "forceSave.php?file=" + url;
107: window.open(forcedSaveUrl, 'save_iframe', 'width=1,height=1');

/wt3/forceSave.php:

  1. <?php
  2. //code posted by chrisputnam at gmail dot com
  3. function readfile_chunked($filename,$retbytes=true)
  4. {
  5. $chunksize = 1(10241024); // how many bytes per chunk
  6. $buffer = '';
  7. $cnt =0;
  8. // $handle = fopen($filename, 'rb');
  9. $handle = fopen($filename, 'rb');
  10. if ($handle === false)
  11. {
  12. return false;
  13. }
  14. while (!feof($handle))
  15. {
  16. //read a chunk
  17. $buffer = fread($handle, $chunksize);
  18. //send the chunk
  19. echo $buffer;
  20. //flush the chunk
  21. flush();
  22. //increment the size read/sent
  23. if ($retbytes)
  24. {
  25. $cnt += strlen($buffer);
  26. }
  27. }
  28. //close file
  29. $status = fclose($handle);
  30. if ($retbytes && $status)
  31. {
  32. return $cnt; // return num. bytes delivered like readfile() does.
  33. }
  34. return $status;
  35. }
  36. $filename = $_GET['file'];
  37. if(!$filename)
  38. {
  39. echo "ERROR: No filename specified. Please try again.";
  40. }
  41. else
  42. {
  43. // fix for IE caching or PHP bug issue
  44. header("Pragma: public");
  45. header("Expires: 0"); // set expiration time
  46. header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
  47. // browser must download file from server instead of cache
  48. // force download dialog
  49. header("Content-Type: application/force-download");
  50. header("Content-Type: application/octet-stream");
  51. header("Content-Type: application/download");
  52. // use the Content-Disposition header to supply a recommended filename and
  53. // force the browser to display the save dialog.
  54. header("Content-Disposition: attachment; filename=" . basename($filename) . ";");
  55. header("Content-Transfer-Encoding: binary");
  56. header("Content-Length: " . filesize($filename));
  57. set_time_limit(0);
  58. readfile_chunked($filename, false);
  59. exit();
  60. }
  61. ?>
    `
    --------------------------------------------------------------------------------
Vendor

Electronics for Imaging, Inc. - <http://www.efi.com>

Affected Version

EFI Fiery Controller SW2.0
Xerox DocuColor 260, 250, 242

Tested On

Debian GNU/Linux 3.1
Apache
PHP/5.4.41

Vendor Status

N/A

PoC

efifiery_fd.txt

Credits

Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>

References

[1] <https://packetstormsecurity.com/files/145570>
[2] <https://www.exploit-db.com/exploits/43398/>
[3] <https://cxsecurity.com/issue/WLB-2017120295>
[4] <https://exchange.xforce.ibmcloud.com/vulnerabilities/137018>

Changelog

[27.12.2017] - Initial release
[04.01.2018] - Added reference [1], [2], [3] and [4]

Contact

Zero Science Lab

Web: <http://www.zeroscience.mk>
e-mail: lab@zeroscience.mk

                                        
                                            &lt;html&gt;&lt;head&gt;&lt;title&gt;403 Nothing to see.&lt;/title&gt;
&lt;link rel="Shortcut Icon" href="favicon.ico" type="image/x-icon"&gt;
&lt;style type="text/css"&gt;
&lt;!--
body {
	background-color: #000;
}
body,td,th {
	font-family: Verdana, Geneva, sans-serif;
}
a:link {
	color: #008FEF;
	text-decoration: none;
}
a:visited {
	color: #008FEF;
	text-decoration: none;
}
a:hover {
	text-decoration: underline;
	color: #666;
}
a:active {
	text-decoration: none;
}
--&gt;
&lt;/style&gt;
&lt;/head&gt;
&lt;body bgcolor=black&gt;
&lt;center&gt;
&lt;font color="#7E88A3" size="2"&gt;
&lt;br /&gt;&lt;br /&gt;
&lt;h1&gt;403 Nothing to see.&lt;/h1&gt;

You do not have the powah for this request /403.shtml&lt;br /&gt;&lt;br /&gt;
&lt;font size="2"&gt;&lt;a href="https://www.zeroscience.mk"&gt;https://www.zeroscience.mk&lt;/a&gt;&lt;/font&gt;
&lt;/font&gt;&lt;/center&gt;
&lt;/body&gt;&lt;/html&gt;