CVE-2025-34230
📋 TL;DR
This CVE describes a blind server-side request forgery (SSRF) vulnerability in Vasion Print (formerly PrinterLogic) that allows unauthenticated attackers to make HTTP requests from the vulnerable server to internal network services. The vulnerability exists in the printer registration process where printer hostnames are used without validation to construct URLs. This affects organizations using Vasion Print Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413.
💻 Affected Systems
- Vasion Print Virtual Appliance Host
- Vasion Print Application
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could probe internal services, trigger actions on internal systems, perform port scanning, or potentially chain with other vulnerabilities to achieve remote code execution.
Likely Case
Internal network reconnaissance, service enumeration, and potential data leakage from internal services that respond to HTTP requests.
If Mitigated
Limited to blind SSRF with no direct data exfiltration, but still enables internal network probing.
🎯 Exploit Status
Exploitation requires sending crafted requests to trigger printer registration with malicious hostnames. The vulnerability is blind, meaning attackers cannot directly see responses.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Virtual Appliance Host 25.1.102 or later, Application 25.1.1413 or later
Vendor Advisory: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm
Restart Required: No
Instructions:
1. Update Virtual Appliance Host to version 25.1.102 or later. 2. Update Application to version 25.1.1413 or later. 3. Verify the patch by checking version numbers and testing the vulnerable endpoint.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to the vulnerable endpoint using firewall rules or web application firewall (WAF) rules.
Endpoint Access Control
allImplement authentication or IP whitelisting for the /var/www/app/console_release/hp/log_off_single_sign_on.php endpoint.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the Vasion Print server from sensitive internal networks
- Deploy a web application firewall (WAF) with SSRF protection rules to block malicious requests
🔍 How to Verify
Check if Vulnerable:
Check if the /var/www/app/console_release/hp/log_off_single_sign_on.php endpoint is accessible without authentication and accepts printer registration requests with arbitrary hostnames.Check Version:
Check version through Vasion Print administration interface or consult vendor documentation for version checking commands.Verify Fix Applied:
Verify the software version meets or exceeds the patched versions (VA Host ≥25.1.102, Application ≥25.1.1413) and test that the endpoint no longer processes malicious hostname values.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to /var/www/app/console_release/hp/log_off_single_sign_on.php
- Printer registration attempts with unusual hostnames or IP addresses
- Outbound HTTP requests from the server to internal IP ranges on port 80
Network Indicators:
- HTTP requests from Vasion Print server to internal IP addresses on port 80
- Unusual outbound traffic patterns from the server
SIEM Query:
source_ip="Vasion_Print_Server_IP" AND dest_port=80 AND dest_ip IN (RFC1918_ranges) AND http_user_agent LIKE "%curl%"🔗 References
- https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm
- https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm
- https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-ssrf-06
- https://www.vulncheck.com/advisories/vasion-print-printerlogic-ssrf-via-hp-log-off-single-sign-on-php-script
- https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-ssrf-06
