SB2020032302 - Multiple vulnerabilities in Canon Oce Colorwave 500 printer

Description

This security bulletin contains information about 5 secuirty vulnerabilities.

1) Cross-site request forgery (CVE-ID: CVE-2020-10671)

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin in the printer's web application. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

2) Cross-site scripting (CVE-ID: CVE-2020-10670)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data passed via the "settingId" parameter in the "/SettingsEditor/settingDialogContent.jsp" page. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

3) Cross-site scripting (CVE-ID: CVE-2020-10668)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data passed via the "openSI" parameter in "/home.jsp". A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

4) Stored cross-site scripting (CVE-ID: CVE-2020-10667)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data passed via the "map(template_name)" parameter in "/TemplateManager/indexExternalLocation.jsp". A remote attacker can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

5) Improper Authentication (CVE-ID: CVE-2020-10669)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error on the "/home.jsp" page. A remote attacker on the local network able to connect to the device's web interface can bypass authentication process and get a copy of the documents uploaded by any users.

Remediation

Install update from vendor's website.

References

• http://packetstormsecurity.com/files/156833/Oce-Colorwave-500-CSRF-XSS-Authentication-Bypass.html
• https://www.redtimmy.com/red-teaming/hacking-the-oce-colorwave-printer-when-a-quick-security-assessment-determines-the-success-of-a-red-team-exercise/
• http://seclists.org/fulldisclosure/2020/Mar/24