Threat Response - RCE in Common Unix Printing System (CUPS - CVE-2024-47176)

 

On September 26 2024, a write-up was released describing vulnerabilities associated with CUPS, which is used for network printing using the Internet Printing Protocol (IPP). This vulnerability allows an attacker to perform arbitrary Remote Code Execution on UNIX systems using the CUPS service, potentially leading to unauthorised control over the system. We are writing this Threat Response since this disclosure was highly anticipated and many people feared a high-impact high-risk vulnerability. In this TR, we explain why the the probability of successful exploitation in most enterprise (server) environments is fairly unlikely.

 

A series of at least four vulnerabilities in the Common Unix Printing System (CUPS), that have recently been reported by Simone Margaritelli[1], enable attackers to execute arbitrary code remotely on vulnerable machines. Proof-of-concept code to abuse this vulnerability has been released[2], which prompts us to release this Threat Response now. The CVEs associated to the vulnerabilities in question are:

One of the CUPS components, cups-browsed, which searches for advertised network or shared printers and makes them available for printing, listens on UDP port 631. It also allows remote connections from any device on the network. A remote unauthenticated attacker can silently replace existing printers’ (or install new ones) IPP urls with a malicious one. This enables the threat actor to perform arbitrary command execution on the system that actively utilises this hijacked print service (i.e., there is an active print job requested from the tampered CUPS service).

 

We estimate the impact of this vulnerability to be MEDIUM. While successful exploitations of the vulnerability enable attackers to remotely execute malicious code on target systems, the CUPS service runs with specific (lower privileged) permissions by default in many popular LINUX distributions such as Red Hat and Ubuntu. It is worth mentioning that the author of the write-up proclaims additional (unknown) vulnerabilities that are present within the service.

 

We estimate the risk of the vulnerability as LOW as attackers have several obstacles to get past. Some of the obstacles are:

If CUPS is present in your environment, but not required for any business processes we recommend to take the following actions:

The actions below are recommended in any situation where CUPS is installed and used for business processes:

Verify whether you are running any CUPS services on UNIX-based systems and follow the mitigation-steps above. At the time of writing this threat response, vendors are starting to roll-out patches to their respective distribution. If the service is required within your organisation, we recommend to keep track of any patch-releases and apply them when available.

 

We will monitor any developments regarding this vulnerability. If new critical information about this threat arises we will reach out to you. You can call us by phone or send us an email if you would like additional information.