PrinterLogic vendor addresses triple RCE threat against all connected endpoints

High severity flaws show centralized management means centralized risk, say researchers

UPDATED A trio of vulnerabilities in enterprise print management software PrinterLogic offer attackers a route to remote code execution (RCE) on all connected endpoints, security researchers have revealed.

All assigned a CVSS rating of 8.1, the high severity flaws include object injection (CVE-2021-42631), hardcoded APP_KEY (CVE-2021-42635), and command injection (CVE-2021-42638) issues.

Researchers from The Paranoids, Yahoo’s vulnerability research team, achieved RCE on the web stack server via abuse of PrinterLogic’s single-click printer installation feature.

The bugs, discovered during research conducted between April and June 2021, were addressed by PrinterLogic vendor Vasion in security update 19.1.1.13-SP10, issued on January 21. All prior versions are vulnerable.

The update also addresses a raft of medium and low severity bugs uncovered by Yahoo’s security research arm.

Return on investment

Blaine Herro, a security researcher at Yahoo, says PrinterLogic makes for an appealing attack target, in part because it has an agent that can run on many or all endpoints, and install components on or configure endpoints with administrator-level permissions.

Moreover, “the vendor publishes a customer list, which shows exactly what the return on investment is for attackers,” continues Herro in a technical write-up. “If an attacker finds one vulnerability, [they can] extensively compromise over 140 high-profile organizations.”

However, the severity of the vulnerabilities at hand is lessened by attackers requiring a privileged network position via a VPN or applicable vulnerability in an appliance on the edge, except for internet-facing installations (which applies to few environments, says Herro).

PHP object injection

Herro detailed an exploit that begins with “a pretty classic example” of unauthenticated PHP object injection – a “historically” problematic bug class in PHP applications including ConcreteCMS, Magento, and Moodle.

Once the server is compromised and persistent access secured, attackers could move laterally into arbitrary workstations when users perform single-click installation, which prompts the PrinterLogic workstation client (PrinterInstallerClient) to pull down and install the relevant driver package.

Herro sets out how to control the contents of a driver package sent to an endpoint on macOS and Linux or Windows by manipulating the database, thereby gaining an arbitrary filesystem write on connected endpoints.

“The added bonus is that PrinterInstallerClient runs as root,” he adds.

There are “a few options across each platform that aren’t particularly difficult” for executing code on endpoints that receive driver packages, says the researcher. He explains how to do so on macOS by injecting a script among scheduled maintenance scripts run by the periodic service.

Abusing scoping criteria

Unsatisfied with duping potential marks into downloading a specific backdoored printer driver, the researchers unearthed a feature that enabled them to push drivers to arbitrary endpoints.

Specifically, printers can be deployed to endpoints running PrinterInstallerClient according to scoping criteria. This criteria includes hostnames, which can be specified as a wildcard, thereby scoping the printer to all endpoints that are clients of the web stack server.

This means attackers can achieve RCE “on all connected endpoints that are clients of the Web Stack server, or compromise select endpoints as they see fit, without requiring further user interaction,” says Herro.

He adds: “As your company grows in size, it’s only natural to reach for enterprise products that simplify management of key functionality that many of your employees use (in this case, printers). A byproduct of centralized management, however, is centralized risk.”

Vasion comment

A spokesperson for Vasion said: “Vasion Security worked side by side with The Paranoids, a Verizon Media security team, to release the CVE’s mentioned in January after all vulnerabilities were resolved.

“While the initial discovery of vulnerabilities was tied to our Web Stack platform, our remediation efforts went beyond that to also include the PrinterLogic Virtual Appliance and PrinterLogic SaaS. Corrective measures have already been applied to SaaS and are now live.

“Vasion wants to thank the Paranoids Research team at Verizon Media. We appreciate customers with a strong sense of security, who are willing to help harden our product offerings.”

This article was updated on January 27 with comments from Vasion

DON’T FORGET TO READ Chain of vulnerabilities led to RCE on Cisco Prime servers