Tuesday, June 25, 2024

PrinterLogic RCE: vendor addresses triple threat against all connected endpoints

PrinterLogic has released security updates to address a total of nine vulnerabilities in Web Stack and Virtual Appliance, including three security defects that carry “high severity” ratings.

Tracked as CVE-2021-42631, CVE-2021-42635, and CVE-2021-42638, the three high-risk bugs can be exploited launch remote code execution attacks, according to an advisory from the Paranoids vulnerability research team.

All three security flaws carry a CVSS base score of 8.1, but each is a different type of vulnerability: CVE-2021-42631 is an object injection bug, CVE-2021-42635 is a hardcoded APP_KEY issue, while CVE-2021-42638 is described as miscellaneous command injections.

To resolve these issues, PrinterLogic reorganized the impacted endpoints to eliminate the use of objects passed as parameters, modified the installers so that random keys would be generated, and completely removed areas affected by the command injections (where removal was not possible, escaping/sanitation was addressed).

The remaining security holes include: SQLi may disclose audit logs (CVE-2021-42633), blind SSRF (CVE-2021-42637), miscellaneous reflected XSS (CVE-2021-42639), driver assignment IDOR (CVE-2021-42640), username/email info disclosure (CVE-2021-42641), and printer console username/password info disclosure (CVE-2021-42642).

The Paranoids researchers noted that the majority of PrinterLogic installations are not directly accessible from the Internet.

“That means attackers would first need a privileged network position — such as access through a VPN or another (SSRF, perhaps) vulnerability in an appliance on the edge — to exploit the PrinterLogic Web Stack server,” the researchers explained.

The vulnerabilities impact all PrinterLogic Web Stack version 19.1.1.13 SP9 and earlier, and Virtual Appliance version 20.0.1304 and earlier, when used with macOS or Linux endpoint client software.

PrinterLogic Web Stack version 19.1.1.13-SP10 includes the necessary patches, but no client software updates are required for Virtual Appliance. In a separate advisory, PrinterLogic also notes that patches were automatically pushed to its SaaS platform worldwide.

Recommended:  Hacker Who Stole Ed Sheeran Songs Jailed

You may also enjoy reading, Assange Wins First Stage in Effort to Appeal US Extradition

Got to Cybersecurity News

Go to Homepage

Go to Cybersecurity Academy

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for RiSec Weekly Cybersecurity Newsletter Today

Bookmark
ClosePlease login
Share the word, let's increase Cybersecurity Awareness as we know it
- Sponsored -

Sponsored Offer

Unleash the Power of the Cloud: Grab $200 Credit for 60 Days on DigitalOcean!

Digital ocean free 200

Discover more infosec

User Avatar
Steven Black (n0tst3)
Hello! I'm Steve, an independent security researcher, and analyst from Scotland, UK. I've had an avid interest in Computers, Technology and Security since my early teens. 20 years on, and, it's a whole lot more complicated... I've assisted Governments, Individuals and Organizations throughout the world. Including; US DOJ, NHS UK, GOV UK. I'll often reblog infosec-related articles that I find interesting. On the RiSec website, You'll also find a variety of write-ups, tutorials and much more!

more infosec reads

Subscribe for weekly updates

explore

more

security