An automatic scanner has been launched to assist safety professionals scan environments for gadgets susceptible to the Frequent Unix Printing System (CUPS) RCE flaw tracked as CVE-2024-47176.
The flaw, which allows attackers to carry out arbitrary distant code execution if sure circumstances are met, was disclosed late final month by the one who found it, Simone Margaritelli.
Though its RCE side seems restricted in real-world deployments because of the stipulations for exploitation, Akamai later confirmed that CVE-2024-47176 additionally opened the chance for 600x amplification in distributed denial of service (DDoS) assaults.
The scanner was created by cybersecurity researcher Marcus Hitchins (aka “MalwareTech”), who created the scanner to assist system directors scan their networks and rapidly determine gadgets working susceptible CUPS-Browsed providers.
“The vulnerability arises from the truth that cups-browsed binds its management port (UDP port 631) to INADDR_ANY, exposing it to the world. Since requests usually are not authenticated, anybody able to reaching the management port can instruct cups-browsed to carry out printer found.”
“In circumstances when the port just isn’t reachable from the web (as a consequence of firewalls or NAT), it might nonetheless be reachable by way of the native community, enabling privilege escalation and lateral motion.”
“Because of this, I’ve created this scanner designed to scan your native community for susceptible cups-browsed cases.” – Marcus Hitchins
How the scanner works
The Python script (cups_scanner.py) units up an HTTP server on the scanning machine that listens for incoming HTTP requests (callbacks) from gadgets on the community.
CVE-2024-47176 arises from CUPS-browsed (a daemon a part of CUPS) binding its management port (UDP port 631) to INADDR_ANY, exposing the port to the community and permitting any system to ship instructions to it.
The scanner sends a customized UDP packet to the community’s broadcast deal with on port 631, despatched to every IP deal with within the specified vary, telling CUPS cases to ship a request again.
If a tool working a susceptible cups-browsed occasion receives the UDP packet, it can interpret the request and ship an HTTP callback to the server, so solely people who reply are marked as susceptible.
Supply: GitHub
The outcomes are written in two logs: one (cups.log) containing the IP addresses and CUPS model of the gadgets that responded and one (requests.log) containing the uncooked HTTP requests obtained by the callback server that can be utilized for deeper evaluation.
By utilizing this scanner, system directors can plan and execute focused patching or reconfiguration motion, minimizing the publicity of CVE-2024-47176 on-line.
BleepingComputer has not examined the script and can’t guarantee its effectiveness or security, so it’s best to use it at your personal danger.
