DDIVRT-2008-19 HP JetDirect Web Administration Directory Traversal Feb 04 2009 02:42PM
vulnerabilityresearch ddifrontline com


DDIVRT-2008-19 HP JetDirect Web Administration Directory Traversal




Date Discovered


October 23, 2008

Discovered By


Digital Defense, Inc. Vulnerability Research Team

Credit: Shmoov and r@b13$

Vulnerability Description


The HP-ChaiSOE/1.0 embedded web server on certain HP JetDirect printers allows a potential attacker to gain read only access to directories and files outside of the web root. An attacker can leverage this flaw to read arbitrary system configuration files, cached documents, etc. Information obtained from an affected host may facilitate further attacks against the host. Exploitation of this flaw is trivial using common web server directory traversal techniques.

Solution Description


The vendor has released an update. See http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c
01623905 for more details.

Digital Defense, Inc. recommends restricting access to the HP JetDirect web administration interface to authorized hosts only.

Tested Systems / Software (with versions)


Embedded web server HP-ChaiSOE/1.0 on:

HP JetDirect 2420

HP JetDirect 4250

Vendor Contact




[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus