Vulnerabilities
Misconfiguration
Runtime Security
Compliance
CVE Vulnerabilities

CVE-2009-0940

Cross-Site Request Forgery (CSRF)

Published: Mar 18, 2009 | Modified: Oct 10, 2018
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
5.1 MEDIUM
AV:N/AC:H/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2009-0940
CWEhttps://cwe.mitre.org/data/definitions/352.html

Multiple cross-site request forgery (CSRF) vulnerabilities in the HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders allow remote attackers to hijack the intranet connectivity of arbitrary users for requests that (1) print documents via unknown vectors, (2) modify the network configuration via a NetIPChange request to hp/device/config_result_YesNo.html/config, or (3) change the password via the Password and ConfirmPassword parameters to hp/device/set_config_password.html/config.

Weakness

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Affected Software

Name Vendor Start Version End Version
8100c_digital_sender Hp - (including) - (including)
9100c_digital_sender Hp - (including) - (including)
9200c_digital_sender Hp - (including) - (including)
9250c_digital_sender Hp - (including) - (including)
Color_laserjet Hp * *
Color_laserjet_1500 Hp * *
Color_laserjet_2500 Hp * *
Color_laserjet_2500l Hp * *
Color_laserjet_2500lse Hp * *
Color_laserjet_2500n Hp * *
Color_laserjet_2500tn Hp * *
Color_laserjet_2605dtn Hp * *
Color_laserjet_4370mfp Hp 20081211_46.211.2 (including) 20081211_46.211.2 (including)
Color_laserjet_4600 Hp * *
Color_laserjet_4600dn Hp * *
Color_laserjet_4600dtn Hp * *
Color_laserjet_4600hdn Hp * *
Color_laserjet_4650 Hp * *
Color_laserjet_4700 Hp * *
Color_laserjet_4730_mfp Hp * *
Color_laserjet_5500 Hp * *
Color_laserjet_5550 Hp * *
Color_laserjet_8500 Hp * *
Color_laserjet_8550 Hp * *
Color_laserjet_9500 Hp * *
Color_laserjet_9500_mfp Hp * *
Color_laserjet_9500mfp Hp 20070719_05.011.2 (including) 20070719_05.011.2 (including)
Color_mfp_cm8050 Hp - (including) - (including)
Color_mfp_cm8060 Hp - (including) - (including)
Digital_senders Hp * *
Edgeline_printers Hp * *
Laserjet_1000 Hp * *
Laserjet_1005 Hp * *
Laserjet_1010 Hp * *
Laserjet_1012 Hp * *
Laserjet_1015 Hp * *
Laserjet_1018 Hp * *
Laserjet_1018s Hp * *
Laserjet_1020 Hp * *
Laserjet_1020_plus Hp * *
Laserjet_1022 Hp * *
Laserjet_1022n Hp * *
Laserjet_1022nw Hp * *
Laserjet_1100 Hp * *
Laserjet_1150 Hp * *
Laserjet_1160 Hp * *
Laserjet_1200 Hp * *
Laserjet_1300 Hp * *
Laserjet_1320 Hp * *
Laserjet_2 Hp * *
Laserjet_2000 Hp * *
Laserjet_2100 Hp * *
Laserjet_2200 Hp * *
Laserjet_2200dtn Hp * *
Laserjet_2300 Hp * *
Laserjet_2300dn Hp * *
Laserjet_2400 Hp * *
Laserjet_2410 Hp 20070410_08.112.3 (including) 20070410_08.112.3 (including)
Laserjet_2420 Hp 20070410_08.112.3 (including) 20070410_08.112.3 (including)
Laserjet_2430 Hp * *
Laserjet_2430 Hp 20070410_08.112.3 (including) 20070410_08.112.3 (including)
Laserjet_2500 Hp * *
Laserjet_2500c Hp * *
Laserjet_2600c Hp * *
Laserjet_2600n Hp * *
Laserjet_3000 Hp * *
Laserjet_3700 Hp * *
Laserjet_4 Hp * *
Laserjet_4/4m Hp * *
Laserjet_4_plus/m_plus Hp * *
Laserjet_4000 Hp * *
Laserjet_4000n Hp * *
Laserjet_4050 Hp * *
Laserjet_4100 Hp * *
Laserjet_4100_mfp Hp * *
Laserjet_4100mfp Hp * *
Laserjet_4200 Hp * *
Laserjet_4200dtn Hp * *
Laserjet_4200ln Hp * *
Laserjet_4240 Hp * *
Laserjet_4240n Hp * *
Laserjet_4250 Hp * *
Laserjet_4250 Hp 20080319_08.015.0 (including) 20080319_08.015.0 (including)
Laserjet_4300 Hp * *
Laserjet_4345_mfp Hp * *
Laserjet_4345mfp Hp 20081211_09.131.1 (including) 20081211_09.131.1 (including)
Laserjet_4350 Hp * *
Laserjet_4350 Hp 20080319_08.015.0 (including) 20080319_08.015.0 (including)
Laserjet_4350dtn Hp * *
Laserjet_4650dn Hp * *
Laserjet_4l/ml Hp * *
Laserjet_4m_plus Hp * *
Laserjet_4p/mp Hp * *
Laserjet_4si Hp * *
Laserjet_4v/mv Hp * *
Laserjet_5 Hp * *
Laserjet_5/m/n Hp * *
Laserjet_500_plus Hp * *
Laserjet_5000 Hp * *
Laserjet_5000 Hp r.25.15 (including) r.25.15 (including)
Laserjet_5000 Hp r.25.47 (including) r.25.47 (including)
Laserjet_5100 Hp * *
Laserjet_5100 Hp v.29.12 (including) v.29.12 (including)
Laserjet_5100dtn Hp * *
Laserjet_5200 Hp * *
Laserjet_5l Hp * *
Laserjet_5m Hp * *
Laserjet_5p/mp Hp * *
Laserjet_5si Hp * *
Laserjet_8000 Hp * *
Laserjet_8100 Hp * *
Laserjet_8150 Hp * *
Laserjet_8150dn Hp * *
Laserjet_9000 Hp * *
Laserjet_9000_mfp Hp * *
Laserjet_9000mfp Hp * *
Laserjet_9040 Hp * *
Laserjet_9040 Hp 20080204_08.110.0 (including) 20080204_08.110.0 (including)
Laserjet_9040mfp Hp * *
Laserjet_9040mfp Hp 20080204_08.110.0 (including) 20080204_08.110.0 (including)
Laserjet_9050 Hp * *
Laserjet_9050 Hp 20080204_08.110.0 (including) 20080204_08.110.0 (including)
Laserjet_9050_mfp Hp * *
Laserjet_9050mfp Hp * *
Laserjet_9050mfp Hp 20080204_08.110.0 (including) 20080204_08.110.0 (including)
Laserjet_9055 Hp * *
Laserjet_9065 Hp * *
Laserjet_9500 Hp * *
Laserjet_9500mfp Hp * *
Laserjet_ii Hp * *
Laserjet_iid Hp * *
Laserjet_iii Hp * *
Laserjet_iiid Hp * *
Laserjet_iiip Hp * *
Laserjet_iiisi Hp * *
Laserjet_iip Hp * *
Laserjet_iip_plus Hp * *
Laserjet_m1522n_mfp Hp * *
Laserjet_m3027_mfp Hp * *
Laserjet_m3035_mfp Hp * *
Laserjet_m4345_mfp Hp * *
Laserjet_m5025_mfp Hp * *
Laserjet_m5035_mfp Hp * *
Laserjet_p1000 Hp * *
Laserjet_p1005 Hp * *
Laserjet_p1006 Hp * *
Laserjet_p1007 Hp * *
Laserjet_p1008 Hp * *
Laserjet_p1009 Hp * *
Laserjet_p1500 Hp * *
Laserjet_p1505 Hp * *
Laserjet_p1505n Hp * *
Laserjet_p2000 Hp * *
Laserjet_p2010 Hp * *
Laserjet_p2015 Hp * *
Laserjet_p2030 Hp * *
Laserjet_p2050 Hp * *
Laserjet_p3000 Hp * *
Laserjet_p3005 Hp * *
Laserjet_p4010 Hp * *
Laserjet_p4014 Hp * *
Laserjet_p4015 Hp * *
Laserjet_p4500 Hp * *
Laserjet_p4510 Hp * *

Potential Mitigations

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]
  • Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]
  • Use the “double-submitted cookie” method as described by Felten and Zeller:
  • When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user’s machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.
  • Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.
  • This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2024 Aqua Security Software Ltd.   Privacy Policy | Terms of Use