Title: HP Web Jetadmin Multiple Vulnerabilities
Severity: CRITICAL
Description:
HP Web Jetadmin is a web-based interface for remote management of network peripheral devices. It is available for Microsoft Windows and Linux-based platforms.
Multiple vulnerabilities have been identified in the application that may allow remote attackers to disclose sensitive information, carry out denial of service attacks, and gain unauthorized access to a vulnerable server.
The following specific issues have been reported:
It has been reported that a remote attacker may disclose contents of a script. This issue presents itself when a URI request for a script followed by a '.' is sent to the server. An attacker may disclose sensitive information about the code behind the application that could be used to launch further attacks against a system.
Another information disclosure issue existing in the application may allow an attacker to gain access to 'framework.ini' file. The 'framework.ini' file is reported to contain authentication credentials such as password hashes and other sensitive information. It has been reported that this file exists in the web root directory and can be accessed by all. Furthermore, the location of this file can be disclosed by any page that is generated via a '.hts' script. The location is specified in a HTML comment line.
Jetadmin is also reported to be affected by a weak encryption algorithm used to encrypt user names and passwords. It has been reported that an attacker can gain access to the 'framework.ini' file, which contains authentication hashes. The user name and/or password hash is composed of ASCII representation of hexadecimal numbers containing an initialization vector, the length of encrypted data, and the encrypted data itself. The encryption is performed on the client side and sent to the server. In order to decrypt the information, the algorithm uses the initialization vector as a seed for a random number generator and performs an XOR operation with the upper 8 bits of the pseudo random number and the encrypted data. This encryption algorithm can be easily compromised by disclosing hashes from the 'framework.ini' file containing the initialization vectors and then using these values to decrypt the encrypted authentication credentials. An attacker may also sniff network traffic to steal these hashes and ultimately gain access to a vulnerable server.
A denial of service condition can be caused in the application as well. This issue presents itself when an attacker sends a malformed user name or password hash to the server. Specifically, if a hash containing the value '0xFFFF' for the length of the encrypted data is sent to the server, the application enters an infinite loop resulting in a crash or hang.
An access validation issue has also been identified in the application. Reportedly, access to Jetadmin carried is out via HTTP POST request. A typical POST request contains a variable named 'obj' as:
obj=Framework:CheckPassword;Httpd:SetProfile(Profiles_Admin,password,$_pwd,$__framework_ini)
A remote attacker can easily bypass authentication and gain access to a requested function by omitting 'Framework:CheckPassword;' value from the 'obj' variable and sending the malformed POST request to the server. Furthermore, the 'obj' variable is used to call internal server functions and plug-ins. An attacker can exploit this issue, to execute code and functions dealing with internal data structures and web server files. Various attack techniques involving this issue have been described by the researchers responsible for discovering this issue. These techniques include execution of script code and session hijacking. Other attacks are possible as well.
These issues are reported to affect HP Web JetAdmin 6.5 and prior. HP Web JetAdmin is reported to be immune to the file execution issue via the 'obj' variable of POST requests but may still be prone to the other issues.
Affected Products:
- HP Web Jetadmin 6.5.0
- HP Web Jetadmin 7.0.0
References:
- HP: HP Web Jetadmin Homepage
- HP: SSRT2397 rev.0 Web Jetadmin potential denial of service, unauthorized access
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
