Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com

CVE-2024-47076

Description

CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format conversion tasks needed in Printer Applications. The `cfGetPrinterAttributes5` function in `libcupsfilters` does not sanitize IPP attributes returned from an IPP server. When these IPP attributes are used, for instance, to generate a PPD file, this can lead to attacker controlled data to be provided to the rest of the CUPS system.

POC

Reference

- https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8

- https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47

- https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5

- https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6

Github

- https://github.com/0x7556/CVE-2024-47176

- https://github.com/0xCZR1/PoC-Cups-RCE-CVE-exploit-chain

- https://github.com/782e616c6d/782e616c6d

- https://github.com/Alie-N/cups-vulnerability-exploit

- https://github.com/AxthonyV/CVE-2024-47176

- https://github.com/Kuri119/EvilCups

- https://github.com/MalwareTech/CVE-2024-47176-Scanner

- https://github.com/gumerzzzindo/CVE-2024-47176

- https://github.com/l0n3m4n/CVE-2024-47176

- https://github.com/lkarlslund/jugular

- https://github.com/mutkus/CVE-2024-47076

- https://github.com/nomi-sec/PoC-in-GitHub

- https://github.com/rix4uni/medium-writeups