Critical Wormable Security Flaw Found in Several HP Printer Models

Cybersecurity researchers on Tuesday disclosed multiple security
flaws affecting 150 different multifunction printers (MFPs) from HP
Inc that could be potentially abused by an adversary to take
control of vulnerable devices, pilfer sensitive information, and
infiltrate enterprise networks to mount other attacks.

The two weaknesses — collectively called Printing Shellz^[1] — were discovered and
reported to HP by F-Secure Labs researchers Timo Hirvonen and
Alexander Bolshev on April 29, 2021, prompting the PC maker to
issue^[2]
patches^[3]
earlier this month —

• CVE-2021-39237^[4]
  (CVSS score: 7.1) – An information disclosure vulnerability
  impacting certain HP LaserJet, HP LaserJet Managed, HP PageWide,
  and HP PageWide Managed printers.
• CVE-2021-39238^[5]
  (CVSS score: 9.3) – A buffer overflow vulnerability impacting
  certain HP Enterprise LaserJet, HP LaserJet Managed, HP Enterprise
  PageWide, and HP PageWide Managed products.

“The flaws are in the unit’s communications board and font
parser,” Hirvonen and Bolshev said. “An attacker can exploit them
to gain code execution rights, with the former requiring physical
access while the latter can be accomplished remotely. A successful
attack will allow an adversary to achieve various objectives,
including stealing information or using the compromised machine as
a beachhead for future attacks against an organization.”

CVE-2021-39238’s critical severity rating also stems from that
the vulnerability is wormable, meaning it could be exploited to
self-propagate to other MFPs on the compromised network.

A hypothetical attack scenario could involve embedding an
exploit for the font-parsing flaws in a malicious PDF document and
then social engineering the target into printing the file.
Alternatively, an employee from the victim organization could be
lured into visiting a rogue website, in the process sending the
exploit to the vulnerable MFP directly from the web browser in
what’s known as a cross-site printing^[6]
attack.

“The website would, automatically, remotely print a document
containing a maliciously-crafted font on the vulnerable MFP, giving
the attacker code execution rights on the device,” the researchers
said.

Besides enforcing network segmentation and disabling printing
from USB drives by default, it’s highly recommended for
organizations using the affected devices to install the patches as
soon as they become available. “While exploiting these issues is
somewhat difficult, the public disclosure of these vulnerabilities
will help threat actors know what to look for to attack vulnerable
organizations,” Hirvonen and Bolshev said.