Loading vulnerability…
CVE-2024-47175 is an improper neutralization vulnerability in libppd through version 2.1b1. The ppdCreatePPDFromIPP2 function writes IPP printer attributes into a generated temporary PPD file without adequate validation, sanitization, or escaping. An attacker controlling an IPP printer service can supply crafted attributes that inject attacker-controlled PPD directives. In the CUPS malicious-printer exploit chain, the injected PPD content can be consumed by Foomatic processing and contribute to command execution.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains two distinct C++ utilities: a primary exploit (cups_rce_exploit.cpp with top-level README) and a defensive mitigation tool under Cups-Patcher/. The exploit is a standalone operational PoC for the September 2024 CUPS RCE chain. It implements a rogue TCP IPP server that listens on an attacker-specified IP/port, parses inbound IPP requests from cups-browsed, and returns crafted printer attributes. The key malicious behavior is injection of attacker-controlled content into the media-type-supported attribute, embedding a FoomaticRIPCommandLine directive and cupsFilter entry so the target eventually executes an arbitrary shell command via foomatic-rip. The exploit also supports optionally sending the initial UDP browse/discovery trigger to a target host on port 631, causing cups-browsed to connect back to the rogue IPP server. Payloads are user-supplied at runtime and may be passed directly or loaded from a file, making the exploit flexible but still basic rather than framework-grade. The repository structure is simple: 4 files total, with 2 code files and 2 README files. The main exploit entry point is cups_rce_exploit.cpp. The secondary tool, Cups-Patcher/cups_patcher.cpp, is not an exploit; it is a mitigation utility that disables cups-browsed, edits /etc/cups/cupsd.conf to disable browsing and bind to localhost, adds iptables/ip6tables rules blocking UDP 631, replaces foomatic-rip with a harmless stub, modifies /etc/hosts, creates backups, and supports restore/check/status style operations. This confirms the repository’s overall purpose is both offensive demonstration of the CUPS vulnerability chain and defensive hardening guidance. Notable network observables from the exploit include UDP 631 for the trigger, TCP 631 (or attacker-selected port) for the rogue IPP server, IPP URIs of the form ipp://ATTACKER:PORT/printers/NAME, and device URIs of the form socket://ATTACKER:PORT. Example payload observables in the README include reverse shell traffic to TCP 4444, file writes under /tmp, and retrieval of a second-stage script from http://192.168.1.50/backdoor.sh.
This repository contains a single Metasploit module: 'modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb'. The module exploits several vulnerabilities in OpenPrinting CUPS and related components (cups-browsed, libcupsfilters, libppd, cups-filters) on Linux systems. It allows an attacker on the same LAN to advertise a malicious printer using mDNS (multicast DNS) to the address 224.0.0.251. When a victim sends a print job to this printer, the module delivers a payload via the IPP protocol, resulting in remote code execution as the 'lp' user on the victim's machine. The exploit does not require any open CUPS ports on the victim; only user interaction (sending a print job) is needed. The module references four CVEs (CVE-2024-47076, CVE-2024-47175, CVE-2024-47177, CVE-2024-47176) and is based on public research and exploits. The main attack vector is network-based, leveraging LAN multicast and HTTP/IPP services. The module is operational and allows for customizable payloads via the Metasploit framework.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical network-reachable vulnerability in the cups-filters package on ZTE CGSL Main 7, with no authentication or user interaction required according to the provided CVSS v3 vector.
An input-sanitization flaw in libppd's ppdCreatePPDFromIPP2 function that permits attacker-controlled IPP attributes to be written into PPD data. It can form part of an exploit chain resulting in remote code execution via Foomatic.
Уязвимость в libppd, позволяющая записывать контролируемые атакующим IPP-атрибуты в PPD-файл без экранирования, что даёт возможность внедрить вредоносные директивы и использовать foomatic-rip для выполнения команд в составе цепочки.
An insufficient IPP-attribute validation flaw in the CUPS processing chain that permits malicious PPD data injection from an attacker-controlled IPP server.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.