ATTACKING UNIX SYSTEMS VIA CUPS, PART I

👤 by Simone Margaritelli

A remote unauthenticated attacker can silently replace existing printers’ (or install new ones) IPP urls with a malicious one, resulting in arbitrary command execution (on the computer) when a print job is started (from that computer).

Entry Points
• WAN / public internet: a remote attacker sends an UDP packet to port 631. No authentication whatsoever.
• LAN: a local attacker can spoof zeroconf / mDNS / DNS-SD advertisements and achieve the same code path leading to RCE.

RCE chain
• Force the target machine to connect back to our malicious IPP server.
• Return an IPP attribute string that will inject controlled PPD directives to the temporary file.
• Wait for a print job to be sent to our fake printer for the PPD directives, and therefore the command, to be executed.


📝 Contents:
● Summary
● Intro
● What is cups-browsed?
● Stack Buffer Overflows and Race Conditions
● Back to found_cups_printer
● Internet Printing Protocol
● PostScript Printer Description
● The problematic child: foomatic-rip
● Remote Command Execution chain
● Personal Considerations
● One More Thing


https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/