1

What are the security risks in adding a feature to an application which allows users to test for connectivity from a server to a printer?

I'm planning to add a feature to my application to allow users to click a button which will test whether the server can connect to a printer. The button won't allow the user to send any data, but they will be able to specify the IP address and port of the printer to be connected to.

I'm concerned about the risks that a malicious user might be able to use this feature to carry out network scanning from the server's perspective.

What would be some good controls to add to this kind of facility to minimize any security risks? For example, perhaps I could limit it to a specific port or ports which are used for printer configuration or limit the function to only be usable by a privileged user.

2

You're correct to say that depending on how the application is deployed and who the user's are, there could be some risks in allowing users to do this.

Some controls which would likely help in this kind of scenario

  • Allow administrators to specify a list of valid printers, and then allow users to only choose from that list of printers. This is likely the best option as it removes the user's ability to enter arbitrary IP addresses and ports to the application.
  • As mentioned, restricting to specific ports can reduce the risk, however some printers operate on the common web ports, so this is of limited use.
  • Also restricting which user's can use the facility would reduce the risk.
  • Logging all actions, whilst it won't prevent abuse, could be a useful feature in enabling administrators to spot and react to that abuse after the fact.
  • Thanks for your edit on my post, however you changed the last part of it when editing. I'm wondering too if some part of the security just have to be let to network administrators, meaning setting up a firewall on the server that will host my application instead of doing application checks. In fact there will be 2 different tests : one that test the parameters spécified (host/port) in creation/update menu, another in the list of existing printers when you can only test an already configured printer. Those match two differents URL on the backend. So i guess i should protect the 1st one. – Walfrat Mar 1 '16 at 9:36
  • sorry I mis-interpreted, feel free to edit again :) I'd definitely say that having a pre-defined list of printers and not letting users put in free form data is the way to go. – Rоry McCune Mar 1 '16 at 9:41
  • Well this is what i have, an administration menu where you can test freely IP/Host but can be restricted to privileged users. And on the others menu where printers can be tested, it's an action that can test only existing printer (passing the id of the printer instead of host/port to the backend). – Walfrat Mar 1 '16 at 9:43
1

You can limit it to port 9100 which is a common printer port. You don't need to have your printers set up for raw printing for being able to test "is this IP a printer?", because even if your hosts are set up to print via IPP or such, the printer will usually reply on the 9100 raw port anyways.

631 is the common port for IPP printing.

515 is the common port for LPD printing.

A good idea here, is that you could have a freeform entry, that will allow EITHER a valid printer IP (and a arbitary port), OR a valid print port (but a arbitary IP). And of course, you can set so certain users do have the possibility to do arbitary scans (eg specifying a arbitary IP and port altogheter).

To further protect against abuse, for example automated software and malware, I would suggest implementing a captcha, so each scan must be verified to be performed by a human, and only a single IP may be scanned at a time.

To even harden the possibility to abuse it, you can also have a set time limit between each scan, both globally (across all users) and for each user (either identified by IP, username/password or both)

  • that's a good idea, at the moment, the profile on the application will do the work, but if i'm asked to harden it i'll remember this :) – Walfrat Mar 1 '16 at 15:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.