CVE-2024-47076

What it actually does

CVE-2024-47076 is an improper input validation flaw in OpenPrinting libcupsfilters, specifically in cfGetPrinterAttributes5. The vulnerable code trusts IPP attributes returned by an IPP server and can pass attacker-controlled attribute values into CUPS components, including PPD generation workflows. In isolation, this enables injection of malicious printer metadata into local CUPS configuration artifacts; when combined with related CUPS/cups-filters weaknesses, that injected data can be used to influence filter behavior and may lead to command execution when a user prints to the maliciously added or modified printer.

Why it matters to the business

A successful attack can turn routine printer discovery or printing activity into a foothold for compromise on Linux or Unix-like systems using vulnerable CUPS components. The operational risk is highest on workstations, print servers, and shared desktop environments where printer discovery is enabled or CUPS services are reachable from untrusted networks. Although this issue is not currently listed in CISA KEV and is not marked as ransomware-associated, the exploit maturity is weaponized and the EPSS score is high, so organizations should treat exposed systems as priority remediation targets.

How an attack unfolds

An attacker positions a malicious IPP server where a vulnerable CUPS client or print service can reach it, commonly on the same network segment or anywhere reachable if printer discovery or CUPS-related services are exposed. The attacker causes the victim system to query the malicious IPP endpoint for printer attributes. Because libcupsfilters does not properly sanitize attributes returned by the IPP server, crafted values can be embedded into generated PPD or printer configuration data. Those malicious values are then consumed by the rest of the CUPS printing pipeline. In chained exploitation scenarios, the attacker-controlled PPD content can influence downstream filters and trigger execution behavior when a user or automated process sends a print job to the attacker-controlled printer.

How to fix it

Upgrade affected components to fixed versions as soon as possible. For openprinting/libcupsfilters, update to a version containing commit 95576ec3d20c109332d14672a807353cdc551018 or a later vendor-packaged release. The provided package metadata also lists github.com/nats-io/jwt fixed in 1.1.0; validate whether that package is actually present and relevant in the deployed software inventory before prioritizing it for this CUPS-specific issue. Apply operating system vendor security updates for CUPS, cups-filters, libcupsfilters, libppd, and related OpenPrinting packages because this flaw is commonly discussed as part of a multi-CVE CUPS exploitation chain. If immediate patching is not possible, disable printer auto-discovery services such as cups-browsed where not required, restrict access to CUPS and IPP services to trusted networks only, block unsolicited inbound UDP/TCP traffic associated with printer discovery and IPP from untrusted segments, and remove untrusted or unexpected printers and PPD files.

How to confirm the fix worked

Confirm installed package versions using the operating system package manager and verify that libcupsfilters contains the fixed upstream commit or vendor backport. Validate that CUPS, cups-filters, libcupsfilters, libppd, and cups-browsed packages have all relevant vendor advisories applied rather than relying only on upstream version strings. Check whether cups-browsed is installed and enabled, and confirm whether CUPS/IPP services are listening on network interfaces exposed beyond trusted administrative or local networks. Review /etc/cups/ppd/ for recently created or unexpected PPD files and inspect them for suspicious directives, embedded shell syntax, or references to unusual filters. As a functional validation, attempt printer discovery from an untrusted network segment and confirm that vulnerable systems do not automatically create or trust attacker-supplied printer definitions.

Typical attack path

1. Identify systems running vulnerable CUPS/libcupsfilters components, especially hosts with printer discovery enabled or CUPS-related ports reachable.
2. Expose or advertise a malicious IPP printer service to the target network or otherwise induce the target to query an attacker-controlled IPP endpoint.
3. Return crafted IPP attributes containing malicious printer metadata or PPD-injection content.
4. Allow the vulnerable cfGetPrinterAttributes5 path to incorporate unsanitized attribute data into generated CUPS/PPD configuration.
5. Wait for a user or process to print to the malicious printer or for downstream CUPS components to process the injected configuration.
6. Leverage the injected configuration as part of a broader CUPS exploit chain to execute commands, gain persistence, or move laterally depending on local privileges and configuration.

How to detect it

Review CUPS logs, system logs, service manager logs, endpoint telemetry, and file integrity data for signs that a host queried or added an unexpected IPP printer. Key log sources include /var/log/cups/error_log, /var/log/cups/access_log, journald entries for cupsd and cups-browsed, syslog/auth logs, EDR process trees, and file modification timestamps under /etc/cups/ppd/. Look for new or modified printers that users did not configure, IPP requests to unfamiliar hosts, CUPS processes spawning shells or interpreters, and PPD files containing suspicious directives or shell metacharacters. In network telemetry, investigate unexpected UDP 631 discovery traffic, outbound IPP connections to non-printer systems, and IPP Get-Printer-Attributes responses from unknown hosts. If threat hunting after possible exposure, correlate printer creation or PPD modification times with process launches from cupsd, cups-browsed, foomatic-rip, or other CUPS filter processes.

• /var/log/cups/error_log
• /var/log/cups/access_log
• /etc/cups/ppd/
• cups-browsed
• cupsd
• foomatic-rip
• FoomaticRIPCommandLine
• *FoomaticRIPCommandLine:
• *cupsFilter:
• *cupsFilter2:
• Get-Printer-Attributes
• ipp://
• ipps://
• UDP/631
• TCP/631
• printer-privacy-policy-uri
• printer-more-info
• printer-info
• printer-make-and-model

What your security team should do

• Prioritize patching of internet-exposed, workstation, VDI, print-server, and shared Linux desktop systems because exploit code is weaponized and EPSS indicates elevated likelihood of exploitation.
• Inventory hosts with CUPS, cups-browsed, cups-filters, libcupsfilters, and libppd installed, including appliances and Linux desktop images that may not be covered by standard server patching workflows.
• Disable cups-browsed and automatic printer discovery unless there is a clear business requirement.
• Restrict IPP/CUPS exposure using host firewalls, network ACLs, and segmentation; do not allow untrusted networks to reach CUPS or printer discovery services.
• Hunt for unexpected printer additions, recently modified PPD files, and suspicious CUPS filter execution after the publication date of 2024-09-26.
• Treat suspicious findings as potential chained exploitation and investigate process execution spawned from CUPS-related services such as cupsd, cups-browsed, and foomatic-rip.
• Ensure patching covers the full CUPS exploit chain, not only libcupsfilters, because the most serious outcomes depend on interaction with related printing components.