CVE-2025-34230

Executive Summary

CVE-2025-34230 is a blind server-side request forgery (SSRF) vulnerability in Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application. The flaw exists in the /var/www/app/console_release/hp/log_off_single_sign_on.php script, which is reachable by unauthenticated users. When a printer is registered, the software stores the printer’s hostname in the variable $printer_vo->str_host_address. The code later constructs a URL like http://<host-address>:80/DevMgmt/DiscoveryTree.xml and sends the request using curl without any validation, whitelist, or private-network filtering. This allows an unauthenticated attacker to probe internal services, trigger internal actions, or gather intelligence, albeit blindly (the attacker cannot see the response data directly). The vulnerability has been remediated, but the exact patch introduction date is unclear.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary appliance and SaaS deployment of Vasion Print. No supply chain compromise is involved.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) – likely a placeholder. Based on the description, a reasonable CVSSv3.1 vector is:
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L) – blind SSRF can leak internal service existence
  • Integrity (I): Low (L) – can trigger internal actions
  • Availability (A): None (N)
• Threat Level: Medium (6.5) – unauthenticated, network-accessible, but blind.

Deep Dive & Mechanics

The vulnerability resides in the HP-specific single sign-on (SSO) logoff script. The script processes printer registration data, specifically the str_host_address field. This field is intended to hold the printer’s hostname or IP address. However, the code does not sanitize or validate this input before using it to construct a URL for an HTTP request.

Attack Flow:

1. An attacker registers a malicious printer (or modifies an existing printer’s hostname) with a target internal IP address or hostname (e.g., 192.168.1.1, localhost, metadata.google.internal).
2. The script constructs a URL: http://<attacker-controlled-host>:80/DevMgmt/DiscoveryTree.xml.
3. The script sends a curl request to that URL.
4. The attacker cannot see the response, but can observe side effects (e.g., timing, error logs, or internal service state changes).

Why Blind? The response from the curl request is not returned to the attacker. However, the attacker can still:

• Probe for open ports on internal hosts.
• Trigger actions on internal services (e.g., restart, configuration changes).
• Exfiltrate data via DNS or HTTP redirects (if the internal service responds with a redirect to an attacker-controlled server).

Root Cause: Lack of input validation and absence of a whitelist for allowed hostnames/IPs. The code should restrict requests to known printer IPs or use a proxy with strict allowlisting.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// /var/www/app/console_release/hp/log_off_single_sign_on.php
$printer_vo = get_printer_from_request();
$host = $printer_vo->str_host_address; // No validation
$url = "http://$host:80/DevMgmt/DiscoveryTree.xml";
$response = curl_exec($ch); // No filtering

Patched Code (Conceptual):

// Patched version
$printer_vo = get_printer_from_request();
$host = $printer_vo->str_host_address;
// Validate host is a known printer IP
if (!is_valid_printer_host($host)) {
    log_error("Invalid printer host: $host");
    exit;
}
// Use a whitelist or DNS resolution check
$allowed_hosts = ['10.0.0.1', '10.0.0.2']; // Example
if (!in_array($host, $allowed_hosts)) {
    log_error("Host not allowed: $host");
    exit;
}
$url = "http://$host:80/DevMgmt/DiscoveryTree.xml";
$response = curl_exec($ch);

The patch likely adds host validation, a whitelist, or network filtering to prevent requests to private/internal IPs.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Vasion Print instance (VA or SaaS) with printer registration capability.
• Ability to register a printer with a custom hostname (e.g., via API or web interface).

Exploitation Steps:

1. Register a printer with str_host_address set to an internal target (e.g., 192.168.1.1).
2. Trigger the logoff SSO script (e.g., by sending a crafted request to /hp/log_off_single_sign_on.php).
3. Observe side effects: if the internal service responds, the script may log success/failure. Use timing to infer open ports.

Example Request (Conceptual):

POST /hp/log_off_single_sign_on.php HTTP/1.1
Host: target.vasion.com
Content-Type: application/x-www-form-urlencoded

printer_host=192.168.1.1&action=logoff

Note: No public exploit code is available. This is a blind SSRF, so direct data exfiltration is limited.

Blue Team

Detection:

• Monitor for unusual printer registrations with internal IPs or hostnames.
• Alert on requests to /hp/log_off_single_sign_on.php from unauthenticated sources.
• Look for curl requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8) from the Vasion Print server.

Hunting:

• Search logs for DiscoveryTree.xml requests to non-standard IPs.
• Correlate printer registration events with subsequent SSO logoff requests.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests from Vasion Print server to private IPs on port 80.
  • Requests to /DevMgmt/DiscoveryTree.xml on internal hosts.
• Logs:
  • Unusual printer hostnames in registration logs (e.g., localhost, 127.0.0.1, metadata.google.internal).
  • Errors related to curl failures to internal IPs.
• File System:
  • Modified printer configuration files containing internal IPs.

Detection Engineering

YARA Rule

rule CVE_2025_34230_SSRF {
    meta:
        description = "Detects Vasion Print SSRF vulnerability exploitation"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-34230"
    strings:
        $php_script = "/var/www/app/console_release/hp/log_off_single_sign_on.php"
        $curl_call = "curl_exec"
        $host_var = "str_host_address"
        $discovery_xml = "DiscoveryTree.xml"
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-34230 - Vasion Print Blind SSRF
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects exploitation attempts of blind SSRF in Vasion Print
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/hp/log_off_single_sign_on.php'
        cs-host: 'target.vasion.com'
    condition: selection
falsepositives:
    - Legitimate printer registration with valid hostnames
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-34230 - Vasion Print Blind SSRF"; flow:to_server,established; content:"POST"; http_method; content:"/hp/log_off_single_sign_on.php"; http_uri; content:"printer_host"; http_client_body; pcre:"/printer_host=(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.|127\.)/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade to Vasion Print Virtual Appliance Host version 25.1.102 or later, or Application version 25.1.1413 or later.
• If upgrade is not possible, restrict network access to the Vasion Print server using a firewall (allow only known printer IPs).
• Disable the HP SSO logoff script if not in use.

Long-term:

• Implement input validation for all printer hostnames (allowlist only known IPs).
• Use a proxy with strict egress filtering for all outbound requests.
• Conduct regular security audits of custom scripts.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.