Vulnerability DatabaseCVE-2023-50916

CVE-2023-50916:
Kyocera Device Manager vulnerability analysis and mitigation

Overview

Kyocera Device Manager before version 3.1.1213.0 contains a path traversal vulnerability (CVE-2023-50916) that allows NTLM credential exposure during UNC path authentication. The vulnerability affects the database backup location configuration feature of the application, which is used by administrators to manage large printer fleets. The issue was discovered by Jordan Hedges of Trustwave SpiderLabs and was patched in December 2023 (Trustwave Advisory, Vendor Advisory).

Technical details

The vulnerability stems from improper input validation in the '/backup-restore-service/config/backup-path' endpoint. While the GUI rejects UNC paths containing backslashes, this restriction can be bypassed by intercepting and modifying the request via a proxy or sending requests directly to the endpoint. When a UNC path is set as the backup location, the application attempts to authenticate to it, potentially exposing Windows NTLM hashes depending on the environment configuration. The vulnerability has been assigned a CVSS v3.1 base score of 7.2 (HIGH) with vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (NVD).

Impact

If successfully exploited, this vulnerability could lead to unauthorized access to clients' accounts, data theft, and enable NTLM credential relaying or cracking attacks. The impact is particularly significant in environments where the 'Restrict NTLM: Outgoing NTLM traffic to remote servers' security policy is not enabled (Hacker News).

Mitigation and workarounds

The vulnerability has been fixed in Kyocera Device Manager version 3.1.1213.0. Organizations should upgrade to this version or later to address the security issue. The update implements a validation function that ignores invalid paths and maintains the original valid path (Vendor Advisory).

Community reactions

The vulnerability has garnered attention in the cybersecurity community, with multiple security firms and news outlets covering the issue. The discovery highlights the importance of proper input validation and network segmentation in enterprise environments (Dark Reading).