CUPS flaws allow remote code execution on Linux systems under certain conditions
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-47076 | Unsanitized IPP attribute injection in OpenPrinting libcupsfilters (CWE-20) OpenPrinting's libcupsfilters, the library providing CUPS filter functionality for printer data-format conversion, fails to sanitize IPP attributes returned from IPP servers in its cfGetPrinterAttributes5 function (CWE-20, CVSS 8.6). The flaw is triggered when a system running CUPS contacts an attacker-controlled or untrusted IPP server and uses the returned attributes, for example to generate a PPD file, allowing attacker-controlled data to flow into the rest of the CUPS system. On its own this yields high-integrity attacker data injection (per the CVSS vector, no direct confidentiality or availability loss), but it is one of several CUPS flaws disclosed together in late September 2024 that, when chained under certain conditions, can result in remote code execution on Linux and Unix systems. Any system running libcupsfilters is affected; CUPS and its filter libraries ship by default with most major Linux distributions, and public internet scans around disclosure found roughly 75,000 hosts exposing the IPP service (TCP 631) directly to the internet. Proof-of-concept details are public (an EvilSocket writeup and the OpenPrinting GitHub advisory GHSA-w63j-6g73-wmg5), the flaw is not yet in CISA KEV, and EPSS assigns a 77.6% probability of exploitation within 30 days, though no confirmed in-the-wild exploitation appears in the provided data. Do: Upgrade libcupsfilters to the patched release identified in the OpenPrinting advisory GHSA-w63j-6g73-wmg5 (fixed in libcupsfilters 2.1.0), applying your distribution's updated cups-filters/CUPS packages; also install the companion CUPS component fixes released the same week, since this flaw is typically chained with other CUPS bugs (notably in cups-browsed) for remote code execution. Until patched, restrict or disable exposure of the IPP service (TCP 631) to untrusted networks and avoid creating or refreshing printer queues from untrusted or mDNS-advertised IPP servers. | 8.6 | 78% | PoC ×2 |
| masstens of millions of Linux/Unix systems ship the vulnerable library; ~75,000 hosts expose IPP (TCP 631) directly to the internet per public scans | |
| CVE-2024-47175 | Unsanitized IPP input in OpenPrinting libppd enables RCE chain on Linux CUPS CVE-2024-47175 is an improper input validation flaw (CWE-20) in OpenPrinting's libppd: the ppdCreatePPDFromIPP2 function fails to sanitize IPP attributes when writing them into a generated PPD buffer. When this unsanitized, attacker-controlled input flows through the CUPS print pipeline — for example via the cups-browsed entry point abused in CVE-2024-47176, in combination with functions such as cfGetPrinterAttributes5 — it can ultimately be executed by Foomatic print filters, giving remote code execution. Affected systems are Linux/Unix hosts running the CUPS printing stack with vulnerable libppd components, which includes widely used distributions such as Debian and, per press coverage, most other major Linux distros. Exploitation status: public proofs of concept and researcher write-ups exist, the flaw carries a high EPSS score (63.6% probability of exploitation within 30 days, 99th percentile) and warnings about abuse including DDoS, but it is not yet in CISA's KEV catalog, so no confirmed widespread in-the-wild exploitation is documented in the available data. Do: Install your distribution's security updates — upgrade libppd to the patched release (2.1b1 or later, per the OpenPrinting advisory GHSA-7xfx-47qg-grp6) and apply the matching cups/cups-filters fixes. As interim mitigation, disable or stop cups-browsed if not needed and block or restrict inbound UDP 631 (and IPP/port 631 generally) from untrusted networks, particularly on internet-facing hosts. Check whether CUPS is running and reachable on your systems and whether configured printers rely on Foomatic filters, which the RCE chain requires. | 9.8 | 64% | PoC ×2 |
| largetens of thousands of internet-exposed CUPS hosts (roughly 75,000 per public internet-wide scans at disclosure), on top of a far larger install base of Linux… | |
| CVE-2024-47176 | Unauthenticated RCE chain in OpenPrinting cups-browsed (CVE-2024-47176) CVE-2024-47176 is a flaw in cups-browsed, the network printer auto-discovery component of the OpenPrinting CUPS printing stack shipped with most major Linux and Unix distributions, which binds to UDP port 631 on all interfaces (INADDR_ANY) and therefore accepts and trusts unauthenticated packets from any source. A remote attacker can send a crafted browse/IPP packet that makes cups-browsed issue a Get-Printer-Attributes IPP request to an attacker-controlled URL. On its own this flaw is rated Medium (5.3), but chained with companion flaws in libcupsfilters (CVE-2024-47076), libppd (CVE-2024-47175), and cups-filters (CVE-2024-47177) it enables unauthenticated arbitrary command execution when a user prints to the attacker's malicious printer; the exposure has also been noted as abusable for DDoS amplification. Any Linux/Unix system running cups-browsed with UDP/631 reachable from an untrusted network is affected. No confirmed widespread in-the-wild exploitation has been reported and the flaw is not yet in CISA's KEV, but public proofs of concept exist and EPSS assigns a ~51% probability of exploitation within 30 days (99th percentile). Do: Update cups-browsed and the companion cups-filters/libcupsfilters/libppd packages to the patched releases published by OpenPrinting and your distribution alongside the September 2024 advisories (see GHSA-rj88-6mr5-rcw8). If patched packages are not yet available, stop or disable the cups-browsed service, or firewall inbound UDP port 631 from untrusted networks and ensure it binds only to localhost where network printer discovery is not needed. Audit whether cups-browsed is running and whether UDP/631 is reachable from the internet, and treat any network-reachable CUPS host as a candidate for the full RCE chain. | 5.3 | 51% | PoC ×2 |
| massmillions of Linux/Unix installations (cups-browsed ships in the default print stack of major distributions), of which only on the order of tens of thousands of… | |
| CVE-2024-47177 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-47076, CVE-2024-47175, CVE-2024-47176. Reason: This candidate is a duplicate of CVE-2024-47076, CVE-2024-47175, and CVE-2024-47176. Notes: All CVE users should reference CVE-2024-47076, CVE-2024-47175, and/or CVE-2024-47176 instead of this candidate. This CVE was issued to a vulnerability that is dependent on CVE-2024-47076, CVE-2024-47175, and CVE-2024-47176. According to rule 4.2.15 of the CVE CNA rules, \"CNAs MUST NOT assign a different CVE ID to a Vulnerability that is fully interdependent with another Vulnerability. The Vulnerabilities are effectively the same single Vulnerability and MUST use one CVE ID. NVD description · AI analysis pending | — | — | — | — |
Full article851 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
September 27, 2024
A researcher has disclosed details of an unpatched Linux vulnerability, initially labeled as critical, that allows remote code execution.
The popular cybersecurity researcher Simone Margaritelli (@evilsocket) disclosed technical details of an unpatched vulnerability impacting Linux systems.
On September 23, Margaritelli announced plans to disclose an unauthenticated remote code execution (RCE) vulnerability affecting all GNU/Linux systems within two weeks. The flaw was rated as critical and received a CVSS score of 9.9. Margaritelli expressed disappointment with the responsible disclosure process, explaining that despite his disclosure, no CVE had been assigned, and, to make matters worse, no one was working to address the issue.
“Devs are still arguing about whether or not some of the issues have a security impact. I’ve spent the last 3 weeks of my sabbatical working full time on this research, reporting, coordination and so on with the sole purpose of helping and pretty much only got patronized because the devs just can’t accept that their code is crap – responsible disclosure: no more.” said the expert.
* Unauthenticated RCE vs all GNU/Linux systems (plus others) disclosed 3 weeks ago.
— Simone Margaritelli (@evilsocket) September 23, 2024
* Full disclosure happening in less than 2 weeks (as agreed with devs).
* Still no CVE assigned (there should be at least 3, possibly 4, ideally 6).
* Still no working fix.
* Canonical, RedHat and… pic.twitter.com/N2d1rm2VeR
Information about the Linux vulnerability was leaked on GitHub, for this reason, the Italian researcher decided to release the technical details and published a proof-of-concept (PoC) exploit on September 26, 2024.
The researcher disclosed four vulnerabilities, tracked as CVE-2024-47076, CVE-2024-47175, CVE-2024-47176 and CVE-2024-47177, impacting the CUPS (Common UNIX Printing System) open-source printing system. CUPS provides tools to manage, discover and share printers for Linux distributions.
The vulnerabilities are IPP attribute sanitization, command execution, and packet trust issues.
Below are the details provided by the researcher:
- CVE-2024-47176 | cups-browsed <= 2.0.1 binds on UDP INADDR_ANY:631 trusting any packet from any source to trigger a
Get-Printer-AttributesIPP request to an attacker controlled URL. - CVE-2024-47076 | libcupsfilters <= 2.1b1
cfGetPrinterAttributes5does not validate or sanitize the IPP attributes returned from an IPP server, providing attacker controlled data to the rest of the CUPS system. - CVE-2024-47175 | libppd <= 2.1b1
ppdCreatePPDFromIPP2does not validate or sanitize the IPP attributes when writing them to a temporary PPD file, allowing the injection of attacker controlled data in the resulting PPD. - CVE-2024-47177 | cups-filters <= 2.0.1
foomatic-ripallows arbitrary command execution via theFoomaticRIPCommandLinePPD parameter.
“A remote unauthenticated attacker can silently replace existing printers’ (or install new ones) IPP urls with a malicious one, resulting in arbitrary command execution (on the computer) when a print job is started (from that computer).” wrote the expert.
A remote, unauthenticated attacker can achieve arbitrary code execution by replacing IPP URLs with a malicious one. This allows the attacker to execute commands when a print job starts on the targeted device.
Red Hat warned that chaining these vulnerabilities could lead to remote code execution, resulting in data theft or damage to critical production systems.
“By chaining this group of vulnerabilities together, an attacker could potentially achieve remote code execution which could then lead to theft of sensitive data and/or damage to critical production systems.” reads the advisory published by Red Hat, which rated the issues with a severity impact of Important because the issues don’t impact default configurations. “Red Hat rates these issues with a severity impact of Important. While all versions of RHEL are affected, it is important to note that affected packages are not vulnerable in their default configuration.”
An attacker can exploit these vulnerabilities through a specific sequence of actions. First, the cups-browsed service must be manually enabled or started on the targeted machine. For an attack to be successful, the attacker needs access to a vulnerable server. This can happen either through unrestricted public internet access or by gaining access to an internal network where local connections are trusted.
Once the attacker obtains access to the system, they can advertise a malicious IPP server, essentially tricking the system into provisioning a malicious printer. When a victim attempts to print from this compromised device, the attacker can then execute arbitrary code on the victim’s machine, potentially leading to a full system compromise. This vulnerability chain relies on the trust placed in network printers and weak access controls.
These vulnerabilities have yet to be addressed, however, Margaritelli claims CUPS developers have admitted that the vulnerabilities cannot be easily fixed. As temporary mitigation, when printing is not needed, users can run two commands to stop a vulnerable service and prevent it from restarting when the system is rebooted.
To stop a running cups-browsed service, an administrator should use the following command:
$ sudo systemctl stop cups-browsedThe cups-browsed service can also be prevented from starting on reboot with:
$ sudo systemctl disable cups-browsedBlocking all traffic to UDP port 631 and DNS-SD traffic can also mitigate attacks.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, LINUX CUPS flaws)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/169001/hacking/cups-flaws-allow-rce-on-linux-systems.html