CVE-2024-47850

What it actually does

The flaw allows an unauthenticated remote attacker to trigger an HTTP POST request from the vulnerable service to an arbitrary destination and port by sending a single crafted IPP UDP packet, enabling SSRF that can be abused for DDoS amplification.

Why it matters to the business

Attackers can abuse the service as an unwitting amplifier in large-scale denial-of-service campaigns, potentially causing service outages, increased bandwidth costs, and operational disruption without direct compromise of the target system.

How an attack unfolds

An attacker sends a crafted IPP UDP packet requesting addition of a printer; the service responds by issuing an HTTP POST to the attacker-chosen target and port, allowing the attacker to spoof requests and amplify traffic against chosen victims.

How to fix it

Upgrade cri-o to version 1.27.3 or later. If cups-browsed is present, upgrade to 2.5b1 or newer. Restrict inbound UDP 631 traffic and disable unnecessary printer discovery features where possible.

How to confirm the fix worked

Confirm cri-o version is 1.27.3 or higher; test that unsolicited IPP UDP packets no longer result in outbound HTTP POST requests to arbitrary endpoints.

Typical attack path

1. Attacker crafts and sends a single IPP UDP packet to the exposed cups-browsed service.
2. Service processes the packet and issues an HTTP POST to the attacker-specified destination and port.
3. Repeated packets generate amplified traffic toward the victim, contributing to DDoS.
4. Victim experiences resource exhaustion or bandwidth saturation.

How to detect it

Review network logs and service logs for unexpected outbound HTTP POST requests triggered by inbound IPP UDP packets on port 631; look for repeated printer-addition requests from untrusted sources.

What your security team should do

• Immediately upgrade cri-o to 1.27.3 across all clusters.
• Apply network controls to limit exposure of UDP port 631.
• Monitor for unexpected outbound HTTP POST traffic originating from nodes running the service.