full-disclosure - Amusing xss against some lexmark printers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu, 6 Jan 2011 13:28:49 +1100
From: dave b <db.pub.mail@...il.com>
To: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Amusing xss against some lexmark printers

Good morning. I think for most people on this list, the PJL RDYMSG
printer display message prank would not be new.
However, what is amusing is that some lexmark (and dell) printers
display the actual text on the printer display in their web interface
without escaping it. This can be used to xss the web interface.
Side note: a lot of printers will display it(the text) in an image and
are not vulnerable.

Here is one device which is known to have this problem and you can
easily find via google
1. Lexmark X651de (google for  'Lexmark X651de "Device Status" ')

You can use nmap to set the RDYMSG of a printer and xss the printer
web interface:
nmap --script=pjl-ready-message.nse
--script-args='pjl_ready_message="<script>alert(1);</script>"' . [0]

Note: you should also be able to use OPMSG and STMSG to xss the web interface.

[0] - http://nmap.org/nsedoc/scripts/pjl-ready-message.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/