CVE-2024-47176

What it actually does

CVE-2024-47176 is a network-exposed flaw in cups-browsed where the service binds to all interfaces on port 631 and accepts CUPS browse packets from untrusted sources. An attacker can send a crafted packet that causes the target to issue an IPP Get-Printer-Attributes request to an attacker-controlled URL, creating an SSRF-style callback and potentially registering attacker-controlled printer attributes. When chained with related CUPS vulnerabilities such as CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177, the malicious printer metadata can lead to arbitrary command execution when a user or automated process prints to the attacker-supplied printer.

Why it matters to the business

Systems running vulnerable cups-browsed may be remotely manipulated over the network and, in common exploit chains, can be turned into command-execution targets without prior authentication. The immediate operational risk is highest for Linux or Unix-like endpoints and servers with printing services enabled, especially where UDP port 631 is reachable from untrusted networks. Because public weaponized exploitation exists and EPSS is high, organizations should treat exposed instances as urgent even though this CVE is not currently listed in CISA KEV and is not specifically marked as ransomware-associated.

How an attack unfolds

An attacker first identifies a host running cups-browsed with UDP port 631 reachable. They send a crafted CUPS browse announcement to the service, which is accepted because cups-browsed listens on INADDR_ANY and does not sufficiently restrict the packet source. The packet directs the victim to query an attacker-controlled IPP endpoint using Get-Printer-Attributes. The attacker's IPP server returns malicious printer attributes that can cause the victim to add or trust a rogue printer definition. In the full weaponized chain, the rogue printer data includes unsafe PPD or filter attributes that are later interpreted by CUPS components; once a user or process prints to that printer, the malicious command is executed in the printing context. Attackers may use this to establish a foothold, run shell commands, download payloads, or pivot further inside the network.

How to fix it

Upgrade affected components to fixed versions. For openprinting/cups-browsed, use a version containing commit 1debe6b140c37e0aa928559add4abcc95ce54aa2 or later. For github.com/ory/oathkeeper, use 0.38.12-beta.1 or later where applicable to dependency tracking. If immediate patching is not possible, disable and stop cups-browsed on systems that do not require printer auto-discovery, restrict UDP and TCP port 631 to trusted print-management networks only, block inbound UDP/631 from untrusted networks, and prevent outbound IPP/HTTP callbacks from print services to arbitrary external destinations. Remove untrusted or unexpected printers and inspect PPD files before re-enabling printing. Where supported, disable legacy remote printer discovery protocols and rely on explicitly configured trusted printers.

How to confirm the fix worked

Confirm installed CUPS and cups-browsed packages include the vendor fix or the upstream commit 1debe6b140c37e0aa928559add4abcc95ce54aa2. Verify cups-browsed is not listening on untrusted interfaces unless required by running checks such as ss -lunp and ss -ltnp for port 631. From an untrusted network segment, confirm UDP/631 and TCP/631 are blocked. Review /etc/cups/printers.conf and /etc/cups/ppd/ for unexpected printers or recently modified PPD files. Validate that print workflows still function after patching or disabling cups-browsed. For dependency inventories that include github.com/ory/oathkeeper, verify version 0.38.12-beta.1 or later is present where relevant.

Typical attack path

1. Scan for hosts exposing CUPS or cups-browsed on UDP/TCP port 631.
2. Send a crafted CUPS browse packet to the target cups-browsed service.
3. Cause the target to initiate an IPP Get-Printer-Attributes request to an attacker-controlled URL.
4. Return malicious printer attributes or PPD-related data from the attacker-controlled IPP service.
5. Wait for the rogue printer to be used by a user, scheduled job, or automated print workflow.
6. Trigger execution through the chained CUPS vulnerabilities and run attacker-controlled commands in the printing service context.
7. Use the resulting access to stage malware, collect data, or pivot to additional systems.

How to detect it

Review host logs, CUPS logs, network telemetry, and EDR process data for signs of prior exploitation. Key sources include systemd journal entries for cups-browsed and cups, /var/log/cups/error_log, /var/log/cups/access_log, /var/log/cups/page_log, syslog, firewall logs, DNS logs, proxy logs, NetFlow, and EDR command/process lineage. Look for inbound UDP/631 packets from unusual sources, especially internet or non-print-server addresses, followed by outbound IPP or HTTP requests from the host to unfamiliar destinations. Search for unexpected printer creation or modification events, recently changed files under /etc/cups/ppd/, and printer definitions in /etc/cups/printers.conf that users or administrators did not configure. Inspect PPD files for suspicious directives such as FoomaticRIPCommandLine or shell metacharacters. In EDR, prioritize process trees where cupsd, cups-browsed, foomatic-rip, or CUPS filter processes spawn /bin/sh, bash, curl, wget, nc, Python, Perl, or other non-printing utilities. If suspicious activity is found, preserve CUPS configuration, PPD files, relevant logs, and packet captures before remediation.

• UDP/631 inbound to cups-browsed from non-print-server sources
• TCP/631 outbound from cups-browsed or cupsd to untrusted external hosts
• Get-Printer-Attributes
• FoomaticRIPCommandLine
• /etc/cups/ppd/
• /etc/cups/printers.conf
• /var/log/cups/error_log
• /var/log/cups/access_log
• /var/log/cups/page_log
• cups-browsed
• cupsd
• foomatic-rip
• /usr/lib/cups/filter/foomatic-rip
• /bin/sh spawned by cupsd
• /bin/sh spawned by foomatic-rip
• bash spawned by cupsd
• bash spawned by foomatic-rip
• curl spawned by cupsd
• wget spawned by cupsd
• nc spawned by cupsd
• python spawned by cupsd
• perl spawned by cupsd

What your security team should do

• Immediately identify Linux and Unix-like assets running cups-browsed or exposing port 631, prioritizing internet-facing systems and workstations on untrusted networks.
• Patch cups-browsed to a fixed build containing commit 1debe6b140c37e0aa928559add4abcc95ce54aa2 or the equivalent distribution vendor update.
• Disable cups-browsed wherever automatic printer discovery is not business-critical.
• Block inbound UDP/631 and restrict TCP/631 to trusted print servers and administrative networks.
• Hunt for unexpected printer additions, suspicious PPD content, and CUPS filter processes spawning shells or network utilities.
• Inspect egress logs for print services making unexpected HTTP or IPP requests to external hosts.
• Remove rogue printers and rebuild CUPS configuration from trusted sources if compromise is suspected.
• Add EDR/SIEM detections for foomatic-rip, cupsd, or cups-browsed spawning command shells, curl, wget, Python, Perl, or other payload-staging tools.