An automatic scanner has been launched to assist safety professionals scan environments for units weak to the Frequent Unix Printing System (CUPS) RCE flaw tracked as CVE-2024-47176.
The flaw, which allows attackers to carry out arbitrary distant code execution if sure circumstances are met, was disclosed late final month by the one who found it, Simone Margaritelli.
Though its RCE facet seems restricted in real-world deployments because of the conditions for exploitation, Akamai later confirmed that CVE-2024-47176 additionally opened the chance for 600x amplification in distributed denial of service (DDoS) assaults.
The scanner was created by cybersecurity researcher Marcus Hitchins (aka “MalwareTech”), who created the scanner to assist system directors scan their networks and shortly establish units operating weak CUPS-Browsed companies.
“The vulnerability arises from the truth that cups-browsed binds its management port (UDP port 631) to INADDR_ANY, exposing it to the world. Since requests are usually not authenticated, anybody able to reaching the management port can instruct cups-browsed to carry out printer found.”
“In instances when the port is just not reachable from the web (resulting from firewalls or NAT), it might nonetheless be reachable by way of the native community, enabling privilege escalation and lateral motion.”
“For that reason, I’ve created this scanner designed to scan your native community for weak cups-browsed cases.” – Marcus Hitchins
How the scanner works
The Python script (cups_scanner.py) units up an HTTP server on the scanning machine that listens for incoming HTTP requests (callbacks) from units on the community.
CVE-2024-47176 arises from CUPS-browsed (a daemon a part of CUPS) binding its management port (UDP port 631) to INADDR_ANY, exposing the port to the community and permitting any system to ship instructions to it.
The scanner sends a customized UDP packet to the community’s broadcast handle on port 631, despatched to every IP handle within the specified vary, telling CUPS cases to ship a request again.
If a tool operating a weak cups-browsed occasion receives the UDP packet, it would interpret the request and ship an HTTP callback to the server, so solely those who reply are marked as weak.
Supply: GitHub
The outcomes are written in two logs: one (cups.log) containing the IP addresses and CUPS model of the units that responded and one (requests.log) containing the uncooked HTTP requests obtained by the callback server that can be utilized for deeper evaluation.
By utilizing this scanner, system directors can plan and execute focused patching or reconfiguration motion, minimizing the publicity of CVE-2024-47176 on-line.
BleepingComputer has not examined the script and can’t guarantee its effectiveness or security, so it is best to use it at your individual danger.
