CUPS Vulnerability (CVE-2024-47176): Bash Audit and Mitigation for Forgotten Linux Servers

In late September 2024, a chain of vulnerabilities was discovered in the CUPS printing system that allowed remote code execution. Patches and mitigations were released at the time, but old, unpatched, and forgotten machines still exist. This guide explains what the chain of vulnerabilities entailed, how to check if you’re vulnerable, and how to secure your system. There’s no need to panic, but it’s important to check.

What it was about

On September 26, 2024, security researcher Simone Margaritelli (known as evilsocket) published an analysis of several vulnerabilities in the publishing system’s components. The most significant ones were as follows:

• CVE-2024-47176 (cups-browsed): The service listened on UDP port 631 on all interfaces and trusted every packet from any source. Based on this, it executed an IPP request to an address chosen by the attacker.
• CVE-2024-47076 (libcupsfilters): Data returned by the “printer” was not sanitized.
• CVE-2024-47175 (libppd): Values from a PPD file could be exploited to inject commands.
• CVE-2024-47177 (cups-filters): The foomatic-rip filter allowed arbitrary commands to be executed via the FoomaticRIPCommandLine parameter in the PPD file.

The attack worked as follows: the attacker forced the vulnerable machine to register a fake printer whose description contained malicious values. When a print job was then sent to the printer, the command was executed. According to available analyses, this was not a case of purely unconditional control over the machine. Someone had to actually print to that printer. This was also the reason why the initial “critical” assessment and headlines about millions of compromised systems turned out to be exaggerated.

Who this applies to

The claim that CUPS is preinstalled on nearly every distribution is an oversimplification. CUPS is often found on desktop systems. However, the vulnerable component, `cups-browsed`, is not present on every machine and is not necessary on most servers. A machine running a vulnerable version of cups-browsed (prior to 2.0.1) and accessible via UDP port 631 could have been vulnerable.

Repair Status

• Distributors quickly released updates that fix or work around CVE-2024-47176, 47076, and 47175.
• CVE-2024-47177 was primarily addressed through mitigations. Changes in behavior in other patched components make it harder to exploit, and some distributions have marked it as deferred pending a redesign of the solution.
• Simply disabling `cups-browsed` was considered an insufficient solution. Other attack vectors via IPP remained open if someone on the machine connected to a compromised printer. Therefore, it is also necessary to apply the update.

Step 1: Audit (read-only)

The script doesn't change anything. It checks whether the services are running, whether they're enabled, and who is listening on port 631.

#!/usr/bin/env bash
# Audit CUPS a cups-browsed. Skript nič nemení.
set -u

echo "== Služby =="
for s in cups cups.socket cups.path cups-browsed; do
  printf '%-14s aktívna: %-10s zapnutá: %sn' "$s" 
    "$(systemctl is-active "$s" 2>/dev/null)" 
    "$(systemctl is-enabled "$s" 2>/dev/null)"
done

echo
echo "== Sockety na porte 631 =="
ss -tulnp 2>/dev/null | awk 'NR==1 || /:631[[:space:]]/'

echo
echo "== Verzie balíkov =="
if command -v dpkg >/dev/null 2>&1; then
  dpkg -l 2>/dev/null | awk '/^ii/ && /cups-browsed|cups-filters|libcupsfilters|libppd|cups-daemon/ {print $2, $3}'
fi
if command -v rpm >/dev/null 2>&1; then
  rpm -qa 2>/dev/null | grep -Ei 'cups-browsed|cups-filters|libcupsfilters|libppd' || true
fi

As a result, please read the following. If cups-browsed is neither active nor installed, your machine is not vulnerable in this way. If it is listening on UDP 631 on all addresses (0.0.0.0 or [::]), this is a warning. Compare the version with the patched version listed in your distribution’s security advisory, not with the number in this article, because distributions often release patches under the same version number.

Step 2: Correction and Mitigation

1. Update the packages using your usual package manager and restart the affected services.
2. Remove what you don't need. On a server without printing capabilities, cups-browsed has no purpose. Disable it: sudo systemctl disable --now cups-browsed. If you don’t need CUPS either, uninstall that as well.
3. Add a firewall as an additional layer of security. Do not consider it a substitute for updates.

UFW (Ubuntu, Debian)

sudo ufw insert 1 deny in proto udp to any port 631
sudo ufw status numbered

If you need to allow a trusted network, add a rule before this one allow with your network's address.

firewalld (RHEL, CentOS, Fedora)

sudo firewall-cmd --list-all
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" port port="631" protocol="udp" drop'
sudo firewall-cmd --reload

In the default firewalld zones, port 631 is usually not open. Check the output of the command --list-allto see if the service ipp or ipp-client.

What a firewall can't solve

• An attacker on the same local network could have accessed the service through means other than a direct packet on UDP 631, such as via printer discovery (mDNS/DNS-SD). Blocking a single port is therefore not enough.
• A rule that blocks only incoming traffic does not protect a machine that connects to a malicious printer on its own.
• Machines outside your management, such as laptops or virtual machines, must be checked separately.

What to Take Away From This

This vulnerability is a good example of how a forgotten service expands the attack surface. The best protection is old-fashioned and boring: update and disable everything the machine doesn’t need. An audit using the script above this text takes one minute per machine, and for a fleet of servers, it can be run via a configuration management tool.