Vulnerabilities in Printix Cloud Print Management

Impact

An attacker is able to read tokens of other users and can change program parameters, such as dependent libraries, external binary dependencies or the uninstallation script that gets executed when the application is removed from the system. Ultimately, tampering with the configuration of Printix in the registry can lead to an elevation of privileges.

Technical Details

The Printix software is running as a background service and a client application, which, on Windows systems, is reading its configuration values from registry keys at HKLM/SOFTWARE/printix.net/Printix Client/CurrentVersion. Every user has their own subkey within this registry key.

Every regular user can read the Printix registry keys of other users that were logged in to the same computer at least once. One of the entries within the key is an access token. Other global entries within the printix.net registry key include the paths of certain third-party libraries and binaries the application relies on. An attacker could overwrite the paths and let them point to their own, malicious libraries, which consequently might be loaded by the application.

<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.3" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
    <RegistrationInfo>
        <Date>2017-09-21T13:43:01</Date>
        <Author>Printix</Author>
        <URI>\Printix Service</URI>
    </RegistrationInfo>
    <Triggers>
        <EventTrigger>
        <Enabled>true</Enabled>
        <Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="Application"&gt;&lt;Select Path="Application"&gt;*[System[Provider[@Name='PrintixClient'] and EventID=249]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>
        </EventTrigger>
    </Triggers>
    <Principals>
        <Principal id="Author">
            <UserId>S-1-5-18</UserId>
            <RunLevel>LeastPrivilege</RunLevel>
        </Principal>
    </Principals>
    <Settings>
        <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
        <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
        <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
        <AllowHardTerminate>true</AllowHardTerminate>
        <StartWhenAvailable>false</StartWhenAvailable>
        <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
        <IdleSettings>
            <StopOnIdleEnd>true</StopOnIdleEnd>
            <RestartOnIdle>false</RestartOnIdle>
        </IdleSettings>
        <AllowStartOnDemand>true</AllowStartOnDemand>
        <Enabled>true</Enabled>
        <Hidden>false</Hidden>
        <RunOnlyIfIdle>false</RunOnlyIfIdle>

<DisallowStartOnRemoteAppSession>false</DisallowStartOnRemoteAppSession>
        <UseUnifiedSchedulingEngine>true</UseUnifiedSchedulingEngine>
        <WakeToRun>false</WakeToRun>
        <ExecutionTimeLimit>PT1H</ExecutionTimeLimit>
        <Priority>1</Priority>
    </Settings>
    <Actions Context="Author">
        <Exec>
            <Command>cmd</Command>
            <Arguments>/c "netsh start PrintixService"</Arguments>
        </Exec>
    </Actions>
</Task>

<Exec>
    <Command>c:\windows\system32\cmd</Command>
    <Arguments>/c "whoami > c:\temp\output.txt"</Arguments>
</Exec>

nt authority\system

Precondition

An attacker has access to the system, modifies the mentioned registry keys and is able to inject their own malicious binaries, that are written in a way that the anti-malware solution in use is not able to detect them.

Impact

An attacker could utilise the whitelisted outbound and inbound ports for establishing new connections to servers under their control and potentially use it for data exfiltration.

Technical details

The printix.net application is installed in C:\Program Files\printix.net\Printix Client and contains a batch script called open_firewall.cmd that configures the Windows Firewall to allow communication to and from the Printix Client to services outside the local system.

Source: C:\Program Files\printix.net\Printix Client\open_firewall.cmd

@ECHO *************************************************
@ECHO * Delete Printix Client inbound ports
@ECHO *************************************************
netsh advfirewall firewall delete rule name="Printix SNMP, UDP"
netsh advfirewall firewall delete rule name="Printix PDP, UDP"
netsh advfirewall firewall delete rule name="Printix Raw Print , TCP"
netsh advfirewall firewall delete rule name="Printix Jobforward, TCP"
netsh advfirewall firewall delete rule name="Printix Redirector, TCP"
netsh advfirewall firewall delete rule name="Printix Task Manager, TCP"
netsh advfirewall firewall delete rule name="Printix UI Communication, TCP"
netsh advfirewall firewall delete rule name="Printix IPP Print, TCP"

@ECHO *************************************************
@ECHO * Adding Printix Client inbound ports
@ECHO *************************************************
netsh advfirewall firewall add rule name="Printix PDP, UDP" protocol=UDP dir=in localport=21337 action=allow
netsh advfirewall firewall add rule name="Printix Jobforward, TCP" protocol=TCP dir=in localport=21335 action=allow
netsh advfirewall firewall add rule name="Printix Redirector, TCP" protocol=TCP dir=in localport=21336 action=allow
netsh advfirewall firewall add rule name="Printix UI Communication, TCP" protocol=TCP dir=in localport=21338 action=allow
netsh advfirewall firewall add rule name="Printix IPP Print, TCP" protocol=TCP dir=in localport=21339 action=allow

@ECHO **************************************************
@ECHO * Adding Printix Client outbound ports
@ECHO **************************************************
netsh advfirewall firewall add rule name="Printix SNMP, UDP" protocol=UDP dir=out localport=161 action=allow
netsh advfirewall firewall add rule name="Printix PDP, UDP" protocol=UDP dir=out localport=21337 action=allow
netsh advfirewall firewall add rule name="Printix Raw Print , TCP" protocol=TCP dir=out localport=9100 action=allow
netsh advfirewall firewall add rule name="Printix Jobforward, TCP" protocol=TCP dir=out localport=21335 action=allow
netsh advfirewall firewall add rule name="Printix Redirector, TCP" protocol=TCP dir=out localport=21336 action=allow
netsh advfirewall firewall add rule name="Printix UI Communication, TCP" protocol=TCP dir=out localport=21338 action=allow
netsh advfirewall firewall add rule name="Printix IPP Print, TCP" protocol=TCP dir=out localport=21339 action=allow

The script seems to have been run during the standard installation on the tested device as the configured rules can also be seen when checking Windows Firewall settings.

Precondition

An attacker has access to the system and is able to run an application to communicate through one of the opened ports without being detected by an installed Antivirus application.

Impact

A manipulated user information in the JWT leads to a manipulated Windows registry path. An attacker can use this vulnerability to modify printer configuration and to receive printed documents of other users.

Technical details

Printix is a cloud printing solution that was installed on endpoints in a tested environment. Users could sign into Printix using their Microsoft accounts by clicking onto the system tray icon of Printix and then selecting the Sign in button.

When doing that, a browser window is opened for the URL sign-in.printix.net. Several URL parameters are added as well, with one of them being a JSON Web Token as shown below.

Source: Example login URL

https://auth.printix.net/oauth/authorize/tenant/<tenant_id>?response_type=code&client_id=PrintixClient&client_secret=<secret>&state=<username>&redirect_uri=http

Source: Decoded JWT Content

{
 "tenantID": "<tenant_id>",
 "state": "user2",
 "prompt": "login",
 "client_id": "PrintixClient",
 "SPRING_SECURITY_SAVED_REQUEST": {
     "requestUrl": "https:\/\/auth.printix.net:443\/oauth\/authorize\/tenant\/<tenant_id>?response_type=code&client_id=PrintixClient&client_secret=1234&state=user2&redirect_uri=http:\/\/localhost:21339\/oauth\/authorize&prompt=login",
     "queryString": "response_type=code&client_id=PrintixClient&client_secret=1234&state=user2&redirect_uri=http:\/\/localhost:21339\/oauth\/authorize&prompt=login" }
 }

Usually, all these attributes of the payload cannot be modified, as servers also check the signature that is part of the JWT. In the case of Printix however, this signature is not verified at all. The signature can be replaced with any text and the server will still accept the token as valid.

When changing the state attribute to the value of another user (user B), and replacing it with the original JWT in the URL-Parameter, but afterwards signing in to Printix with the original Microsoft credentials (user A), the sign-in is confirmed by Printix.

The Printix Service running on the system will, after signing in, replace the registry entries of the user B with the username of user A. The consequence is that whenever user B prints a document, it will appear in the Printix online queue of user A.

Further investigation with tampering of the JWT revealed that this also enables an attacker to write new registry keys with SYSTEM privileges to different places. When passing a path traversal, e.g. ..\\..\\foobar (escaped back-slashed), in the state field of the JWT, the Printix service will create registry keys at that location.

Precondition

An attacker has access to the system and the targeted user also has an account on the same machine and prints a document.