Tens of thousands of hosts with CUPS stuck on the Internet at the time of disclosure CVE-2024-47176 - a significant part of them took connections without authentication on UDP 631. When I reproducing this chain in the Docker Lab with cups-browsed 2.0.1, less than two minutes passed from the first UDP package to the command execution through foo-rip. Default configuration, not a single manual action other than sending a task for printing. Two. Minutes.
Three CVE (CVE-2024-47076, CVE-2024-47175, CVE-2024-47176), revealed by Simone Margariteli (@evilocket) in September 2024, turn the “harmless” demo of auto-discovering printers into a full-fledged initial access vector on GNU/Linux, BSD and Solaris. The fourth identifier – CVE-2024-47177 - Rejected (REJECTED) NVD as a duplicate of the first three.
Business logic of attack: why the attacker print spooler
[Applicable: internal pentest, external pentest with available UDP 631]
Print servers are one of the most neglected infrastructure components. Patches for CUPS are delayed because "printers work and so." On internal projects, I see it over and over again: a print server without EDR, no updates, with a config out of the box. Ideal conditions.
What the chain gives to the attacker:
• Initial access (T1190, Application) - cups-browsed accepts UDP packages on port 631 without authentication. From the external network - a direct path to the host. From the internal - mDNS/DNS-SD allow the slope of the printer and circumvent the need for direct access to the port.
• Execution (T1059.004, Unix Shell) - foomatic-rip performs shell-commands specified in the PPD file. This is a documented functionality inherited since 2011.
• Lateral movement (T1210, Exploitation of Remote Services) )- a compromised print server with network access to other subnets becomes pivot point.
Final impact: shell on behalf of the user lp on the target host. Not root, but lp on most distributions is enough to download payloads (T1105, Ingress Tool Transfer), reverse shells and further promotion. According to Elastic Security Labs, user lp in many default configurations has access to telnet - it is not necessary for printing, but the attacker will be useful.
Four CVE - one chain of remote execution of CUPS code
A chain of three vulnerabilities (CVE-2024-47177 rejected by NVD as a duplicate). No one individually gives RCE - only a combination works. Each closes the gap between "received network access" and "fulfilled the code".
CVE-2024-47176: cups-browsed accepts packages from anyone
Package: cups-browsed <= 2.0.1. CVSS: 5.3 Medium by NVD.
Demon cups-browsed tied to UDP INADDR_ANY:631 - listens to all interfaces. Any UDP package from any IP starts Get-Printer-Attributes IPP request to the URL from the package. One package - and cups-browsed itself connects to the attacker's IPP server, automatically registers a front printer. Beauty.
Works if: cups-browsed has been running, BrowseRemoteProtocols in /etc/cups/cups-browsed.conf Includes the value cups, UDP 631 is available to the attacker.
Does not work if: cups-browsed is stopped (on the default shut-off, according to Red Hat), the port only listens to loopback (according to JFrog, Debian 12, RHEL 8, Ubuntu Desktop 22.04/24.04, when fitted, listen only to 127.0.0.1 and 1).
Checking on the target host: sudo systemctl status cups-browsed. If active (running) The demon works and potentially vulnerable. Next: ss -ulnp | grep 631 He will show what addresses he listens to.
CVE-2024-47076 and CVE-2024-47175: attacker data without filtration
Packages: libcupsfilters <= 2.1b1, libppd <= 2.1b1. CVSS: 8.6 High each according to NVD (CVSS:3.1).
When cups-browsed connects to the attacker IPP server, the function cfGetPrinterAttributes5 in libcupsfilters takes IPP-attributes without validation (CVE-2024-47076). Function ppdCreatePPDFromIPP2 in libppd records these attributes into a temporary PPD file without shielding (CVE-2024-47175).
According to JFrog analysis, the reason is designed flaw in the IPP protocol: attributes from the printer are considered trusted. PPD describes the properties of the printer for CUPS: which filters to call and which commands to perform when processing the task. The result: the attacker monitors the contents of the PPD file on the target system. Can inject the directive FoomaticRIPCommandLine with an arbitrary team and directive cupsFilter2, indicating foomatic-rip as a processor.
CVE-2024-47177 (REJECTED): foomatic-rip - 13-year-old hole in commands
Package: cups-filters <= 2.0.1. Initial CVSS rating: 9.9 (until the rejection of CVE). Status of NVD: REJECTED - recognized as duplicate CVE-2024-47076, CVE-2024-47175 and CVE-2024-47176.
Filter foomatic-rip executes commands from the directive FoomaticRIPCommandLine in the PPD file. A similar mechanism has been used since 2011 - HPLIP foomatic-rip-hplip (CVE-2011-2697) and Foomatic fooactive-flerts (CVE-2011-2964), as Elastic Security Labs points out. The corrections were included in those separate packages, but were not transferred to cups-filters/foomatic-rip. The reason, according to JFrog: A complete fix breaks backward compatibility with most existing printer drivers. Thirteen years, and the bug is still here.
Directive cupsFilter2 in PPD specifies an executable file from /usr/lib/cups/filter/which is called when processing the printing task. foomatic-rip - one of these filters, and it, according to architecture, involves the execution of shell commands for document conversion.
Place in kill chain and preconditions for operation print spooler
Full chain of attack:
1. Recon - UDP 631 scanning or detection via mDNS/DNS-SD on the local network
2. Initial Access (T1190) )- sending a UDP-package from a malware IPP server
3. Printer registration - cups-browsed requests attributes, creates a front printer, generates PPD with malicious directives
4. Trigger - the victim user sends the task to print on the substitute printer (the attacker can not initiate printing remotely - a key restriction)
5. Execution (T1059.004) - foomatic-rip performs a command FoomaticRIPCommandLineunder the account lp
6. Post-exploitation - reverse shell, downloading and running payload
Critical moment: there is no RCE appointment without a timeline. According to JFrog, on servers where no one ever prints, payload is never activated - even if the malicious printer is registered. For server infrastructure, this dramatically reduces the real criticality. But for workstations in the office, where employees print every day is a completely different story.
Three CVE (CVE-2024-47076, CVE-2024-47175, CVE-2024-47176), revealed by Simone Margariteli (@evilocket) in September 2024, turn the “harmless” demo of auto-discovering printers into a full-fledged initial access vector on GNU/Linux, BSD and Solaris. The fourth identifier – CVE-2024-47177 - Rejected (REJECTED) NVD as a duplicate of the first three.
Business logic of attack: why the attacker print spooler
[Applicable: internal pentest, external pentest with available UDP 631]
Print servers are one of the most neglected infrastructure components. Patches for CUPS are delayed because "printers work and so." On internal projects, I see it over and over again: a print server without EDR, no updates, with a config out of the box. Ideal conditions.
What the chain gives to the attacker:
• Initial access (T1190, Application) - cups-browsed accepts UDP packages on port 631 without authentication. From the external network - a direct path to the host. From the internal - mDNS/DNS-SD allow the slope of the printer and circumvent the need for direct access to the port.
• Execution (T1059.004, Unix Shell) - foomatic-rip performs shell-commands specified in the PPD file. This is a documented functionality inherited since 2011.
• Lateral movement (T1210, Exploitation of Remote Services) )- a compromised print server with network access to other subnets becomes pivot point.
Final impact: shell on behalf of the user lp on the target host. Not root, but lp on most distributions is enough to download payloads (T1105, Ingress Tool Transfer), reverse shells and further promotion. According to Elastic Security Labs, user lp in many default configurations has access to telnet - it is not necessary for printing, but the attacker will be useful.
Four CVE - one chain of remote execution of CUPS code
A chain of three vulnerabilities (CVE-2024-47177 rejected by NVD as a duplicate). No one individually gives RCE - only a combination works. Each closes the gap between "received network access" and "fulfilled the code".
CVE-2024-47176: cups-browsed accepts packages from anyone
Package: cups-browsed <= 2.0.1. CVSS: 5.3 Medium by NVD.
Demon cups-browsed tied to UDP INADDR_ANY:631 - listens to all interfaces. Any UDP package from any IP starts Get-Printer-Attributes IPP request to the URL from the package. One package - and cups-browsed itself connects to the attacker's IPP server, automatically registers a front printer. Beauty.
Works if: cups-browsed has been running, BrowseRemoteProtocols in /etc/cups/cups-browsed.conf Includes the value cups, UDP 631 is available to the attacker.
Does not work if: cups-browsed is stopped (on the default shut-off, according to Red Hat), the port only listens to loopback (according to JFrog, Debian 12, RHEL 8, Ubuntu Desktop 22.04/24.04, when fitted, listen only to 127.0.0.1 and 1).
Checking on the target host: sudo systemctl status cups-browsed. If active (running) The demon works and potentially vulnerable. Next: ss -ulnp | grep 631 He will show what addresses he listens to.
CVE-2024-47076 and CVE-2024-47175: attacker data without filtration
Packages: libcupsfilters <= 2.1b1, libppd <= 2.1b1. CVSS: 8.6 High each according to NVD (CVSS:3.1).
When cups-browsed connects to the attacker IPP server, the function cfGetPrinterAttributes5 in libcupsfilters takes IPP-attributes without validation (CVE-2024-47076). Function ppdCreatePPDFromIPP2 in libppd records these attributes into a temporary PPD file without shielding (CVE-2024-47175).
According to JFrog analysis, the reason is designed flaw in the IPP protocol: attributes from the printer are considered trusted. PPD describes the properties of the printer for CUPS: which filters to call and which commands to perform when processing the task. The result: the attacker monitors the contents of the PPD file on the target system. Can inject the directive FoomaticRIPCommandLine with an arbitrary team and directive cupsFilter2, indicating foomatic-rip as a processor.
CVE-2024-47177 (REJECTED): foomatic-rip - 13-year-old hole in commands
Package: cups-filters <= 2.0.1. Initial CVSS rating: 9.9 (until the rejection of CVE). Status of NVD: REJECTED - recognized as duplicate CVE-2024-47076, CVE-2024-47175 and CVE-2024-47176.
Filter foomatic-rip executes commands from the directive FoomaticRIPCommandLine in the PPD file. A similar mechanism has been used since 2011 - HPLIP foomatic-rip-hplip (CVE-2011-2697) and Foomatic fooactive-flerts (CVE-2011-2964), as Elastic Security Labs points out. The corrections were included in those separate packages, but were not transferred to cups-filters/foomatic-rip. The reason, according to JFrog: A complete fix breaks backward compatibility with most existing printer drivers. Thirteen years, and the bug is still here.
Directive cupsFilter2 in PPD specifies an executable file from /usr/lib/cups/filter/which is called when processing the printing task. foomatic-rip - one of these filters, and it, according to architecture, involves the execution of shell commands for document conversion.
Place in kill chain and preconditions for operation print spooler
Full chain of attack:
1. Recon - UDP 631 scanning or detection via mDNS/DNS-SD on the local network
2. Initial Access (T1190) )- sending a UDP-package from a malware IPP server
3. Printer registration - cups-browsed requests attributes, creates a front printer, generates PPD with malicious directives
4. Trigger - the victim user sends the task to print on the substitute printer (the attacker can not initiate printing remotely - a key restriction)
5. Execution (T1059.004) - foomatic-rip performs a command FoomaticRIPCommandLineunder the account lp
6. Post-exploitation - reverse shell, downloading and running payload
Critical moment: there is no RCE appointment without a timeline. According to JFrog, on servers where no one ever prints, payload is never activated - even if the malicious printer is registered. For server infrastructure, this dramatically reduces the real criticality. But for workstations in the office, where employees print every day is a completely different story.
