An automatic scanner has been launched to assist security professionals scan environments for gadgets weak to the Widespread Unix Printing System (CUPS) RCE flaw tracked as CVE-2024-47176.
The flaw, which allows attackers to carry out arbitrary distant code execution if sure circumstances are met, was disclosed late final month by the one that found it, Simone Margaritelli.
Though its RCE side seems restricted in real-world deployments because of the stipulations for exploitation, Akamai later confirmed that CVE-2024-47176 additionally opened the likelihood for 600x amplification in distributed denial of service (DDoS) assaults.
The scanner was created by cybersecurity researcher Marcus Hitchins (aka “MalwareTech”), who created the scanner to assist system directors scan their networks and rapidly establish gadgets operating weak CUPS-Browsed providers.
“The vulnerability arises from the truth that cups-browsed binds its management port (UDP port 631) to INADDR_ANY, exposing it to the world. Since requests are usually not authenticated, anybody able to reaching the management port can instruct cups-browsed to carry out printer found.”
“In instances when the port isn’t reachable from the web (attributable to firewalls or NAT), it might nonetheless be reachable by way of the native community, enabling privilege escalation and lateral motion.”
“Because of this, I’ve created this scanner designed to scan your native community for weak cups-browsed cases.” – Marcus Hitchins
How the scanner works
The Python script (cups_scanner.py) units up an HTTP server on the scanning machine that listens for incoming HTTP requests (callbacks) from gadgets on the community.
CVE-2024-47176 arises from CUPS-browsed (a daemon a part of CUPS) binding its management port (UDP port 631) to INADDR_ANY, exposing the port to the community and permitting any system to ship instructions to it.
The scanner sends a customized UDP packet to the community’s broadcast deal with on port 631, despatched to every IP deal with within the specified vary, telling CUPS cases to ship a request again.
If a tool operating a weak cups-browsed occasion receives the UDP packet, it should interpret the request and ship an HTTP callback to the server, so solely those who reply are marked as weak.
Supply: GitHub
The outcomes are written in two logs: one (cups.log) containing the IP addresses and CUPS model of the gadgets that responded and one (requests.log) containing the uncooked HTTP requests acquired by the callback server that can be utilized for deeper evaluation.
Through the use of this scanner, system directors can plan and execute focused patching or reconfiguration motion, minimizing the publicity of CVE-2024-47176 on-line.
BleepingComputer has not examined the script and can’t guarantee its effectiveness or security, so you must use it at your individual threat.
