HP patches bugs in over 150 printer models

HP has issued patches for a series of vulnerabilities affecting more than 150 of its multifunction printer (MFP) models, which are being revealed for the first time today in a coordinated disclosure with the F-Secure researchers who discovered them.

The vulnerabilities in question are tracked as CVE-2021-39237 and CVE-2021-39238, two access port vulnerabilities, which require physical access, and two font parsing vulnerabilities. They are rated as being of high and critical severity respectively. If exploited successfully, F-Secure consultants Timo Hirvonen and Alexander Bolshev said they could be used to gain full control of a target enterprise’s network.

“It’s easy to forget that modern MFPs are fully functional computers that threat actors can compromise just like other workstations and endpoints. And just like other endpoints, attackers can leverage a compromised device to damage an organisation’s infrastructure and operations,” said Hirvonen.

“Experienced threat actors see unsecured devices as opportunities, so organisations that don’t prioritise securing their MFPs like other endpoints leave themselves exposed to attacks like the ones documented in our research.”

Hirvonen and Bolshev said the most effective method of exploiting these vulnerabilities would be to trick a user at the target organisation into visiting a malicious website and exposing their MFP to a cross-site printing attack whereby the website automatically remotely prints a document containing a maliciously crafted font on the vulnerable device, given the attacker code execution rights.

From there, the attacker can steal any data being run, or that has been cached, on the printer, including not only printed, scanned or faxed documents, but also passwords and login credentials used to connect the printer to the network. In effect, this turns the printer into a beachhead on the network from where the attackers can spread out, establish persistence, and conduct deeper and more disruptive attacks up to data exfiltration and ransomware execution.

Hirvonen and Bolshev believe that exploitation is difficult enough to prevent low-skilled actors from using them, whereas more experienced attackers could easily use them in targeted operations.

“A skilled attacker could successfully exploit the physical ports in a little over five minutes. Exploiting the font parser would only take a few seconds,” they warned. “However, these are not low-hanging fruits that would be obvious to many threat actors. The font parsing issue isn’t the easiest to find or exploit, and anything requiring physical access poses logistical barriers for threat actors to overcome.” 

“Large enterprises, companies working in critical sectors and other organisations facing highly skilled, well-resourced attackers need to take this seriously. There’s no need to panic, but they should assess their exposure, so they’re prepared for these attacks”