CVE-2024-33610 Scanner

Sharp Multifunction Printers are commonly used in various organizations for printing, scanning, and document management solutions. These devices are often deployed in offices, schools, and businesses to manage day-to-day documentation tasks efficiently. They are favored due to their multifunctionality, which includes printing, scanning, copying, and sometimes faxing. The versatility of Sharp printers makes them popular in environments that require high-volume and reliable document processing needs. They are designed with network connectivity to enable easy sharing across multiple users in an office setting. Additionally, these printers often include security features to protect sensitive data handled during various operations.

The Cookie Exposure vulnerability in Sharp Multifunction Printers allows unauthorized listing of session cookies. This vulnerability can be triggered by accessing a specific backdoor webpage without proper authentication. The vulnerability is significant as it enables potential attackers to retrieve session cookies, leading to the hijacking of user sessions. Consequently, this exposure could result in unauthorized access to the printer's administrative functionalities. It poses a threat of data breaches as attackers gain control over sensitive printer operations and settings. Without timely remediation, this vulnerability could be exploited by malicious actors to perpetrate further attacks on an organization's network.

The vulnerability is technically related to the exposure of session cookies through an unauthorized access page. By visiting a specific URL, an attacker can retrieve a list of valid session cookies. This access does not require authentication, allowing attackers to potentially reuse these cookies to assume a legitimate user's session. The exposure page includes details such as the user, last login, last access, and language ID. The primary vulnerable endpoint appears to be the 'sessionlist.html' page, which inadvertently allows access to sensitive cookies. Utilizing these cookies, an attacker can spoof session information, causing significant security concerns for organizations relying on these printers.

Exploiting this vulnerability can result in several significant impacts, including session hijacking, where attackers can impersonate legitimate users. Unauthorized access may allow the attackers to change printer configurations, access stored sensitive documents, and potentially intercept data being printed or scanned. There is also a risk of broader network exposure if the device is compromised and used as a point of entry. Data breaches could occur due to unauthorized access to printed documents containing confidential information. Furthermore, the exploitation could lead to a breach of privacy and compliance issues for organizations obligated to meet specific data protection regulations.

REFERENCES

• https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html#pre-auth-cookies
• https://jvn.jp/en/vu/JVNVU93051062/index.html
• https://global.sharp/products/copier/info/info_security_2024-05.html