lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 22 Aug 2017 15:39:07 +0200
From: RedTeam Pentesting GmbH <>
Subject: [RT-SA-2015-010] WebClientPrint Processor 2.0: Unauthorised Proxy

Advisory: WebClientPrint Processor 2.0: Unauthorised Proxy Modification

RedTeam Pentesting discovered that attackers can configure a proxy host
and port to be used when fetching print jobs with WebClientPrint
Processor (WCPP). This proxy setting may be distributed via specially
crafted websites and is set without any user interaction as soon as the
website is accessed.


Product: Neodynamic WebClientPrint Processor
Affected Versions: (Microsoft Windows)
Fixed Versions: >=
Vulnerability Type: Man-in-the-Middle
Security Risk: medium
Vendor URL:
Vendor Status: fixed version released
Advisory URL:
Advisory Status: published


Neodynamic's WebClientPrint Processor is a client-side application,
which allows server-side applications to print documents on a client's
printer without user interaction, bypassing the browser's print
functionality. The server-side application may be written in ASP.NET or
PHP while on the client-side multiple platforms and browsers are

"Send raw data, text and native commands to client printers without
showing or displaying any print dialog box!" (Neodynamic's website)

More Details

Upon installation under Microsoft Windows, WCPP registers itself as a
handler for the "webclientprint" URL scheme. Thus, any URL starting with
"webclientprint:" is handled by WCPP. For example, entering


in the URL bar of a browser opens the about box of WCPP.

During RedTeam Pentesting's analysis of WCPP it was determined that WCPP
ignores the system proxy configuration and by default tries to fetch
print jobs directly, bypassing a proxy potentially configured in the
system. WCPP can however be configured to use a (possibly different)
proxy through "webclientprint" URLs. For example, visiting the following
URL will set as a proxy IP for WCPP:


Likewise, the port of the proxy can be changed to 14141 through this


As soon as a proxy is initially configured, it will be used permanently
without the need for any further confirmation. If a proxy was already
configured before the URLs above are invoked, the old proxy will be
replaced by the new one.

Proof of Concept

An attacker may prepare a malicious website with the following content:

<iframe src="webclientprint:-proxyHost:">

When visited by a WCPP user, the proxy host will be rewritten without any
user interaction and without any visual indication.

Likewise, the following HTML code may be used to define another proxy
port when visited:

<iframe src="webclientprint:-proxyPort:14141">

This allows the proxy configuration to be changed without authorisation.


Affected users should disable the WCPP handler and upgrade to a fixed
version as soon as possible.


Install a WCPP version greater or equal to[0].

Security Risk

If print jobs are fetched by WCPP over unencrypted HTTP, the
unauthorised change of the proxy configuration may be exploited to yield
a man-in-the-middle position. Attackers only need to trick users into
visiting an attacker-controlled website which contains the configuration
URLs as outlined above. Afterwards, all jobs printed via WCPP and
fetched over HTTP will be requested through the proxy. This may lead to
a disclosure of sensitive information depending on the printed
documents. Furthermore, the integrity of the printed documents cannot be
guaranteed anymore as attackers may also change the documents in

If print jobs are fetched by WCPP over encrypted HTTPS, the unauthorised
change of the proxy configuration results in a denial of service. After
establishing a connection to the proxy, neither an HTTP request nor a
TLS ClientHello is sent. The exact cause was not investigated any

Overall, this vulnerability is rated as a medium risk. This estimation
may need to be adapted depending on the protocol that is used to fetch
print jobs.


2015-08-24 Vulnerability identified
2015-09-03 Customer approved disclosure to vendor
2015-09-04 Asked vendor for security contact
2015-09-04 CVE number requested
2015-09-04 Vendor responded with security contact
2015-09-07 Vendor notified
2015-09-07 Vendor acknowledged receipt of advisory
2015-09-15 Vendor released fixed version
2015-09-16 Customer asked to wait with advisory release until all their
           clients are updated
2017-07-31 Customer approved advisory release
2017-08-22 Advisory released



RedTeam Pentesting GmbH

RedTeam Pentesting offers individual penetration tests performed by a
team of specialised IT-security experts. Hereby, security weaknesses in
company networks or products are uncovered and can be fixed immediately.

As there are only few experts in this field, RedTeam Pentesting wants to
share its knowledge and enhance the public knowledge with research in
security-related areas. The results are made available as public
security advisories.

More information about RedTeam Pentesting can be found at:

Working at RedTeam Pentesting

RedTeam Pentesting is looking for penetration testers to join our team
in Aachen, Germany. If you are interested please visit:

RedTeam Pentesting GmbH                   Tel.: +49 241 510081-0
Dennewartstr. 25-27                       Fax : +49 241 510081-99
52068 Aachen          
Germany                         Registergericht: Aachen HRB 14004
Geschäftsführer:                       Patrick Hof, Jens Liebchen

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists