Directory traversal vulnerability in the HP JetDirect web administration interface in the HP-ChaiSOE 1.0 embedded web server on the LaserJet

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• hp 9200c digital senderup to 20081211_09.131.1 inclusive
• hp color laserjet 4370mfpup to 20081211_46.211.2 inclusive
• hp color laserjet 9500mfpup to 20070719_05.011.2 inclusive
• hp laserjet 2410up to 20070410_08.112.3 inclusive
• hp laserjet 2420up to 20070410_08.112.3 inclusive
• hp laserjet 2430up to 20070410_08.112.3 inclusive
• hp laserjet 4250up to 20080319_08.015.0 inclusive
• hp laserjet 4345mfpup to 20081211_09.131.1 inclusive
• hp laserjet 4350up to 20080319_08.015.0 inclusive
• hp laserjet 9040up to 20080204_08.110.0 inclusive
• hp laserjet 9040mfpup to 20080204_08.110.0 inclusive
• hp laserjet 9050up to 20080204_08.110.0 inclusive
• hp laserjet 9050mfpup to 20080204_08.110.0 inclusive

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A user-supplied file name is joined with the allowed directory, but the result is never checked to confirm it is still inside that directory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const file = path.join(ROOT, req.query.name);2res.sendFile(file);

1const file = path.resolve(ROOT, req.query.name);2if (!file.startsWith(ROOT + path.sep)) {3  return res.sendStatus(400);4}5res.sendFile(file);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.