9 ms·

Wait, this is a joke, right? > A remote unauthenticated attacker can silently replace existing printers’ (or install new ones) IPP urls with a malicious one, r

Wait, this is a joke, right? > A remote unauthenticated attacker can silently replace existing printers’ (or install new ones) IPP urls with a malicious one, resulting in arbitrary command execution (on the computer) *when a print job is started (from that computer).* (emphasis mine) There's no way this is 9.9 when Heartbleed was just 7.5... EDIT: Wanted to add why I think he has overblown this way too much. His original tweet stated "* Unauthenticated RCE vs all GNU/Linux systems (plus others)" but as we can see this isn't nearly the case as on a lot of distros CUPS only listens on loopback or isn't installed at all. Another point: > Full disclosure, I’ve been scanning the entire public internet IPv4 ranges several times a day for weeks, sending the UDP packet and logging whatever connected back. And I’ve got back connections from hundreds of thousands of devices, with peaks of 200-300K concurrent devices If I'm understanding this correctly, he only found 300 thousand open CUPS instances in the whole public IPv4. Remember - the CUPS server needs to receive a print job in order for the RCE to happen, which I doubt most of these instances will get.

voytec 2y ago
From the last image in the article: > 3. Command execution (cups-browsed, cups-filters): 9.9 > CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L - CWE-94
- Tiberium 2y ago
  Yeah, I guess you're right, for CUPS it might be 9.9. My other added points about it being a vastly overblown exploit still stand.
- dfc 2y ago
  But it seems like User Interaction is required.
  - tsimionescu 2y ago
    Printing something at some point arbitrarily later on the system is almost certainly not classed as User Interaction in this sense.
- Arch-TK 2y ago
  This is strictly a miscalculation/fudge. In isolation (which is what CVSS is all about) this is not a network exploitable vulnerability, even if you can craft an attack chain which exploits it over the network. So: AV:N -> AV:L - reason above AC:L - correct PR:N -> PR:L - to exploit this you need to get cups to process a PPD file. Ignoring how it got there, writing a PPD file requires low privileges on the local machine (unless I'm wrong and you can't add a printer to cups as a local user by default, in which case this becomes PR:H with an overall score of 7.7). These might be fulfilled by another component of the attack chain, but again, you need to strictly think in terms of the vulnerability in a vacuum. UI:N -> UI:R - that a user must perform a task after you begin exploitation in order for the exploit to complete is a classical example of required user interaction S:C - correct, attacking cups and getting root on the whole machine is considered a scope change C:L -> C:H - Running arbitrary code as root on a machine is a total breach of all confidentiality of the local machine, so not sure why this was marked as low. I:H - correct A:L -> A:H - Running arbitrary code as root on a machine lets you do anything to completely disable it permanently. Availability impact is high. In summary a score of 8.2 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) for CVE-2024-47177 in a vacuum.
rini17 2y ago
There are also buffer overflows exploitable without any user action. The foomatic vector which requires print job was just one easiest to scan and exploit.
- Tiberium 2y ago
  Thanks, I missed that. But that still leaves us with only 300 thousand exploitable instances in the whole public IPv4 address space. This is nowhere near a universal GNU/Linux RCE. Of course it's still a big deal to those affected servers, but it's nowhere near even RegreSSHion.
  - nullindividual 2y ago
    That's nearly as many as Code Red and roughly 100K more than SQL Slammer.
    - chupasaurus 2y ago
      Add every macOS-running device to the picture (who disables cupsd?)...
      - cowsandmilk 2y ago
        Generally, CUPS on a Mac is bound to localhost. It is highly atypical for a Mac to make it so any computer on the internet or even local network can make requests to its cups server.
        deleted 2y ago
        [deleted]
        tsimionescu 2y ago
        The problem isn't CUPS itself, it's the automatic printer discovery mechanism. That's cups-browsed on Linux, not sure how it's achieved on a Mac. And the printer discovery service can't be firewalled: by definition, it has to listen for outside connections to be in any way useful. This is where things like Windows' trusted VS untrusted networks make sense: it's perfectly nice to allow printers to register to your system on your home network, it's a horrible idea when you connect to an airport wifi.
seanhunter 2y ago
To give the author full credit, they say > Impact wise I wouldn’t classify it as a 9.9, but then again, what the hell do I know?
ezekg 2y ago
> Wait, this is a joke, right? Not gonna lie, I died laughing at the "Look at me, I'm the printer now" meme. So in a way, it did have a good joke regardless of how you rank severity.
znpy 2y ago
The whole thing looks severely overstated. If i was in bad faith i'd say the guy is looking for fame. I wonder, has the guy tried reproducing the exploit on RHEL/Fedora or some other SELinux-protected system? Because this looks like the kind of issue that SELinux would protect you from: 1. cups likely does not have permissions to go and write executable binary files around 2. cups likely does not have permissions to go and exec binaries without the appropriate labels If that's the case, this would really be a testament to SELinux and the final blow to AppArmor or whatever Canonical is shipping nowadays (clearly useless). I still think that maybe you could steal printing document, but i haven't tried. Anyway, i see there's plenty of CUPS-related selinux work documented via manpages. Example: https://www.systutorials.com/docs/linux/man/8-cupsd_selinux/ https://www.systutorials.com/docs/linux/man/8-cupsd_selinux/
- shrubble 2y ago
  The first thing many do in the real world, after installing RHEL or the free derivatives is ... turn off SELinux.
  - worthless-trash 2y ago
    It is a great way to show which people care about security. I equate (and I am likely not alone) that this would be a modern equivalent of chmod -R 777 / in early Unix computing. Use of AppArmour/SElinux is probably a good filter during an interview to determine if a person is a good fit for a security conscious position.
    - iforgotpassword 2y ago
      Hard disagree. FS permissions take like 5 minutes to explain and then you maybe need another 30 minutes in total to try around and get a hang of it. I've given up on selinux every time I've tried to make sense of it. Open 3 different tutorials, have 3 totally different approaches to it. I guess if you only install core packages on redhat and never touch a single config file it might work OK even for the average Joe.
that_guy_iain 2y ago
> There's no way this is 9.9 when Heartbleed was just 7.5... There are tons of 10s and for, what are IMO, really silly things.
Fnoord 2y ago
Apparently there are 300k people in the world who decided they need to have their printer available to the whole internet. It does not make sense, at all, but here we are. I suspect a lot of printers are going to be vulnerable with no patches in sight, but... these should only be available via LAN. Which is still an issue, but less so than it seems.
- gmuslera 2y ago
  Maybe some may fall into the IOT/Embedded category. Wouldn't be very surprise if i.e. a cheap wifi camera have cups installed just because and jumps out in this scan.
- pxc 2y ago
  The I in IPP stands for 'Internet'. I guess some people really mean it.
- tsimionescu 2y ago
  It's not that. Apparently, several major Linux distros, and the cups-browsed developers, have decided for people that any device on the internet should be able to connect to their system as a printer.
  - BenjiWiebe 2y ago
    How do they get around the built-in firewall that's been standard on home routers for the past 15 years?
    - dwattttt 2y ago
      Firewall lets it through: cups-browsed explicitly listens for printers advertising themselves. If it's firewalled off, how can it receive the printer advertisements? I don't know what default firewall rules are configured, but on distros that run it I'd assume it's allowed through, otherwise no reason to run it.
    - tsimionescu 2y ago
      That should protect you from Internet-based attackers, but it doesn't protect you from attackers on the same LAN. For example, if you're in a coffee shop and using their free public wifi, an attacker in that same network can trigger this.
crote 2y ago
Reading through this writeup I'd argue it's indeed quite bad, but more in the sense that the entire `cups-browsed` daemon should probably stop existing, and the Linux ecosystem should have a serious discussion about the future of CUPS in general. These bugs look surprisingly trivial, and upstream response to what is in the end still a fairly serious security issue isn't exactly what one would expect from an installed-by-default desktop Linux package. But no, it's definitely not worth the stop-the-world CVSS 9.9 panic.
- sam_lowry_ 2y ago
  CUPS 3 goes the other way, relying solely on IPP for discovery and autoconfiguration.
- yrro 2y ago
  > the entire `cups-browsed` daemon should probably stop existing It's a legacy component that you don't need with modern printers - cups itself only support IPP Everywhere (printer discovery via mDNS) these days.
worthless-trash 2y ago
Heartbleed was a different CVSS version.
H8crilA 2y ago
Heartbleed is a memory leak, this is a full RCE without user action - RCE obviously implies full information leakage, and more. Specifically the execution is delayed until the next time a user uses their own printer (which config has been substituted by the attacker). And the vulnerability is in cupsd-browser, not cupsd. The author may have some attitude problem, but this is a legit Big Deal vulnerability.
- tga_d 2y ago
  It's RCE (as the lp user, if I'm not mistaken) with user action, and only if the firewall isn't blocking required ports. Most systems, even most systems with CUPS installed, never print anything. The number of systems with no firewall (where "firewall" here could just be NAT) that actually print something is even smaller.
Arch-TK 2y ago
CVSS scores are meaningless in a vacuum, and in this case it seems the redhat person who calculated them took the "fudge it until it looks bad" approach. Below is my professional scoring evaluation while trying to keep to the ideas behind CVSS and the spec as much as I can. Although CVSS is used so rarely in my work (as it usually inappropriate) that I may have made some miscalculations. CVE-2024-47176 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2024-47046 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2024-47175 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVE-2024-47177 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H If I apply the same exact approach to scoring Heartbleed I get: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N The key differences between Heartbleed and the final code execution issue in the attack chain are that Heartbleed is directly over the network (in a vacuum) whereas the code execution is entirely local (in a vacuum, ignoring the previous elements of the attack chain, assuming they were themselves fixed). Additionally with heartbleed there is no user interaction required which also raises the score. But conversely, the direct impact of heartbleed (ignoring what you can do with the information) is that it is only a confidentiality impact (although you could argue that it can lead to a crash which would be a low availability impact bringing the score up to 8.2). I don't think this clarifies much about the scores but hopefully you can see why CVSS scores are meaningless without any context. You need to put them in the context of the environment. The other problem is that in an attack chain, the overall outcome might be bad even if all the individual issues score low. But CVSS doesn't apply to attack chains. At the end of the day, this is a high risk issue (you say many distros have cups listen on loopback, but I think this is not true, 631 tcp is indeed loopback only, but 631 tcp is in fact commonly bound to 0.0.0.0) but only in the context of your laptop which you happen to connect to untrusted networks without a firewall. In summary: This problem as a whole primarily affects desktop systems and some servers. Device running cups exposed to the internet: Critical Device running cups connected to untrusted (but local/non internet routable) networks: High Device running cups connected to trusted networks: Medium

voytec 2y ago

From the last image in the article: > 3. Command execution (cups-browsed, cups-filters): 9.9 > CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L - CWE-94

Tiberium 2y ago
Yeah, I guess you're right, for CUPS it might be 9.9. My other added points about it being a vastly overblown exploit still stand.
dfc 2y ago
But it seems like User Interaction is required.
- tsimionescu 2y ago
  Printing something at some point arbitrarily later on the system is almost certainly not classed as User Interaction in this sense.
Arch-TK 2y ago
This is strictly a miscalculation/fudge. In isolation (which is what CVSS is all about) this is not a network exploitable vulnerability, even if you can craft an attack chain which exploits it over the network. So: AV:N -> AV:L - reason above AC:L - correct PR:N -> PR:L - to exploit this you need to get cups to process a PPD file. Ignoring how it got there, writing a PPD file requires low privileges on the local machine (unless I'm wrong and you can't add a printer to cups as a local user by default, in which case this becomes PR:H with an overall score of 7.7). These might be fulfilled by another component of the attack chain, but again, you need to strictly think in terms of the vulnerability in a vacuum. UI:N -> UI:R - that a user must perform a task after you begin exploitation in order for the exploit to complete is a classical example of required user interaction S:C - correct, attacking cups and getting root on the whole machine is considered a scope change C:L -> C:H - Running arbitrary code as root on a machine is a total breach of all confidentiality of the local machine, so not sure why this was marked as low. I:H - correct A:L -> A:H - Running arbitrary code as root on a machine lets you do anything to completely disable it permanently. Availability impact is high. In summary a score of 8.2 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) for CVE-2024-47177 in a vacuum.

rini17 2y ago

There are also buffer overflows exploitable without any user action. The foomatic vector which requires print job was just one easiest to scan and exploit.

Tiberium 2y ago
Thanks, I missed that. But that still leaves us with only 300 thousand exploitable instances in the whole public IPv4 address space. This is nowhere near a universal GNU/Linux RCE. Of course it's still a big deal to those affected servers, but it's nowhere near even RegreSSHion.
- nullindividual 2y ago
  That's nearly as many as Code Red and roughly 100K more than SQL Slammer.
  - chupasaurus 2y ago
    Add every macOS-running device to the picture (who disables cupsd?)...
    - cowsandmilk 2y ago
      Generally, CUPS on a Mac is bound to localhost. It is highly atypical for a Mac to make it so any computer on the internet or even local network can make requests to its cups server.
      - deleted 2y ago
        [deleted]
      - tsimionescu 2y ago
        The problem isn't CUPS itself, it's the automatic printer discovery mechanism. That's cups-browsed on Linux, not sure how it's achieved on a Mac. And the printer discovery service can't be firewalled: by definition, it has to listen for outside connections to be in any way useful. This is where things like Windows' trusted VS untrusted networks make sense: it's perfectly nice to allow printers to register to your system on your home network, it's a horrible idea when you connect to an airport wifi.

seanhunter 2y ago

To give the author full credit, they say > Impact wise I wouldn’t classify it as a 9.9, but then again, what the hell do I know?

ezekg 2y ago

> Wait, this is a joke, right? Not gonna lie, I died laughing at the "Look at me, I'm the printer now" meme. So in a way, it did have a good joke regardless of how you rank severity.

znpy 2y ago

The whole thing looks severely overstated. If i was in bad faith i'd say the guy is looking for fame. I wonder, has the guy tried reproducing the exploit on RHEL/Fedora or some other SELinux-protected system? Because this looks like the kind of issue that SELinux would protect you from: 1. cups likely does not have permissions to go and write executable binary files around 2. cups likely does not have permissions to go and exec binaries without the appropriate labels If that's the case, this would really be a testament to SELinux and the final blow to AppArmor or whatever Canonical is shipping nowadays (clearly useless). I still think that maybe you could steal printing document, but i haven't tried. Anyway, i see there's plenty of CUPS-related selinux work documented via manpages. Example: https://www.systutorials.com/docs/linux/man/8-cupsd_selinux/ https://www.systutorials.com/docs/linux/man/8-cupsd_selinux/

shrubble 2y ago
The first thing many do in the real world, after installing RHEL or the free derivatives is ... turn off SELinux.
- worthless-trash 2y ago
  It is a great way to show which people care about security. I equate (and I am likely not alone) that this would be a modern equivalent of chmod -R 777 / in early Unix computing. Use of AppArmour/SElinux is probably a good filter during an interview to determine if a person is a good fit for a security conscious position.
  - iforgotpassword 2y ago
    Hard disagree. FS permissions take like 5 minutes to explain and then you maybe need another 30 minutes in total to try around and get a hang of it. I've given up on selinux every time I've tried to make sense of it. Open 3 different tutorials, have 3 totally different approaches to it. I guess if you only install core packages on redhat and never touch a single config file it might work OK even for the average Joe.

that_guy_iain 2y ago

> There's no way this is 9.9 when Heartbleed was just 7.5... There are tons of 10s and for, what are IMO, really silly things.

Fnoord 2y ago

Apparently there are 300k people in the world who decided they need to have their printer available to the whole internet. It does not make sense, at all, but here we are. I suspect a lot of printers are going to be vulnerable with no patches in sight, but... these should only be available via LAN. Which is still an issue, but less so than it seems.

gmuslera 2y ago
Maybe some may fall into the IOT/Embedded category. Wouldn't be very surprise if i.e. a cheap wifi camera have cups installed just because and jumps out in this scan.
pxc 2y ago
The I in IPP stands for 'Internet'. I guess some people really mean it.
tsimionescu 2y ago
It's not that. Apparently, several major Linux distros, and the cups-browsed developers, have decided for people that any device on the internet should be able to connect to their system as a printer.
- BenjiWiebe 2y ago
  How do they get around the built-in firewall that's been standard on home routers for the past 15 years?
  - dwattttt 2y ago
    Firewall lets it through: cups-browsed explicitly listens for printers advertising themselves. If it's firewalled off, how can it receive the printer advertisements? I don't know what default firewall rules are configured, but on distros that run it I'd assume it's allowed through, otherwise no reason to run it.
  - tsimionescu 2y ago
    That should protect you from Internet-based attackers, but it doesn't protect you from attackers on the same LAN. For example, if you're in a coffee shop and using their free public wifi, an attacker in that same network can trigger this.

crote 2y ago

Reading through this writeup I'd argue it's indeed quite bad, but more in the sense that the entire `cups-browsed` daemon should probably stop existing, and the Linux ecosystem should have a serious discussion about the future of CUPS in general. These bugs look surprisingly trivial, and upstream response to what is in the end still a fairly serious security issue isn't exactly what one would expect from an installed-by-default desktop Linux package. But no, it's definitely not worth the stop-the-world CVSS 9.9 panic.

sam_lowry_ 2y ago
CUPS 3 goes the other way, relying solely on IPP for discovery and autoconfiguration.
yrro 2y ago
> the entire `cups-browsed` daemon should probably stop existing It's a legacy component that you don't need with modern printers - cups itself only support IPP Everywhere (printer discovery via mDNS) these days.

worthless-trash 2y ago

Heartbleed was a different CVSS version.

H8crilA 2y ago

Heartbleed is a memory leak, this is a full RCE without user action - RCE obviously implies full information leakage, and more. Specifically the execution is delayed until the next time a user uses their own printer (which config has been substituted by the attacker). And the vulnerability is in cupsd-browser, not cupsd. The author may have some attitude problem, but this is a legit Big Deal vulnerability.

tga_d 2y ago
It's RCE (as the lp user, if I'm not mistaken) with user action, and only if the firewall isn't blocking required ports. Most systems, even most systems with CUPS installed, never print anything. The number of systems with no firewall (where "firewall" here could just be NAT) that actually print something is even smaller.

Arch-TK 2y ago

CVSS scores are meaningless in a vacuum, and in this case it seems the redhat person who calculated them took the "fudge it until it looks bad" approach. Below is my professional scoring evaluation while trying to keep to the ideas behind CVSS and the spec as much as I can. Although CVSS is used so rarely in my work (as it usually inappropriate) that I may have made some miscalculations. CVE-2024-47176 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2024-47046 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2024-47175 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVE-2024-47177 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H If I apply the same exact approach to scoring Heartbleed I get: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N The key differences between Heartbleed and the final code execution issue in the attack chain are that Heartbleed is directly over the network (in a vacuum) whereas the code execution is entirely local (in a vacuum, ignoring the previous elements of the attack chain, assuming they were themselves fixed). Additionally with heartbleed there is no user interaction required which also raises the score. But conversely, the direct impact of heartbleed (ignoring what you can do with the information) is that it is only a confidentiality impact (although you could argue that it can lead to a crash which would be a low availability impact bringing the score up to 8.2). I don't think this clarifies much about the scores but hopefully you can see why CVSS scores are meaningless without any context. You need to put them in the context of the environment. The other problem is that in an attack chain, the overall outcome might be bad even if all the individual issues score low. But CVSS doesn't apply to attack chains. At the end of the day, this is a high risk issue (you say many distros have cups listen on loopback, but I think this is not true, 631 tcp is indeed loopback only, but 631 tcp is in fact commonly bound to 0.0.0.0) but only in the context of your laptop which you happen to connect to untrusted networks without a firewall. In summary: This problem as a whole primarily affects desktop systems and some servers. Device running cups exposed to the internet: Critical Device running cups connected to untrusted (but local/non internet routable) networks: High Device running cups connected to trusted networks: Medium