CVE-2024-47175 - CUPS 'libppd' Remote Code Execution Vulnerability Exploitation Via Foomatic

Introduction: CUPS (Common UNIX Printing System) is a standards-based, open-source printing system used primarily in Unix-like operating systems. It is designed to provide a robust, extensible infrastructure for printing documents, allowing third-party applications to easily implement custom print drivers. CUPS offers its legacy PPD file support through a library called libppd.

In this long-read post, we will discuss an intriguing vulnerability identified in CUPS' libppd, specifically the ppdCreatePPDFromIPP2 function. This vulnerability allows attackers to inject user-controlled input into the system, leading to code execution via the Foomatic user-maintained driver database. We will also touch upon how this vulnerability can be leveraged for remote code execution (RCE) by exploiting CVE-2024-47176.

Vulnerability Details: The libppd function ppdCreatePPDFromIPP2 in CUPS fails to sanitize IPP (Internet Printing Protocol) attributes when creating a PPD buffer. When used in tandem with other functions, like cfGetPrinterAttributes5, this vulnerability can permit user-controlled input to execute arbitrary code via Foomatic. Consequently, attackers can exploit this weakness in libppd as part of an attack chain, resulting in remote code execution (RCE).

Here's a code snippet showcasing the lack of input validation

ppd_file_t *                              /* O - PPD file */
ppdCreatePPDFromIPP2(cups_file_t *fp,      /* I - File to write to */
                      ...
{
    ...
    snprintf(newvalue, sizeof(newvalue), "*%s %s: \"%s\"", newattr, value, ptr);

    cupsFilePrintf(fp, "%s\n", newvalue);
    ...
}

In this code snippet, the ppdCreatePPDFromIPP2 function writes the generated PPD buffer to a file without properly sanitizing input, allowing for potential security issues.

Exploit Chain: CUPS can be used with the Foomatic user-maintained driver database which bridges CUPS with various open-source print drivers. This same database can convert IPP attributes into a Foomatic queue, which is then executed as part of the printing process. This exploitation path can also be combined with CVE-2024-47176, leading to full blown RCE.

Mitigation: To mitigate this vulnerability, it is essential to apply appropriate input validation and sanitation techniques in the affected functions. Users should also follow the available patches and keep their systems up to date with the latest security improvements.

Original References

1. CUPS GitHub Repository: https://github.com/apple/cups
2. CUPS Official Documentation: https://www.cups.org/documentation.php
3. Foomatic Project: https://wiki.linuxfoundation.org/openprinting/foomatic_home
4. IPP Specification: https://tools.ietf.org/html/rfc8011

Conclusion: The CVE-2024-47175 vulnerability in CUPS' libppd poses a significant security risk, as it allows attackers to execute arbitrary code via the Foomatic user-maintained driver database. By exploiting this vulnerability, attackers can achieve remote code execution (RCE). To prevent the exploitation of this vulnerability, developers must apply proper input validation and sanitation techniques. Users should also stay up-to-date with available security patches and improvements to fortify their systems.

Timeline

Published on: 09/26/2024 22:15:04 UTC
Last modified on: 09/30/2024 12:46:20 UTC