Rejected duplicate CVE-2024-47177

Repository contains two distinct C++ utilities: a primary exploit (cups_rce_exploit.cpp with top-level README) and a defensive mitigation tool under Cups-Patcher/. The exploit is a standalone operational PoC for the September 2024 CUPS RCE chain. It implements a rogue TCP IPP server that listens on an attacker-specified IP/port, parses inbound IPP requests from cups-browsed, and returns crafted printer attributes. The key malicious behavior is injection of attacker-controlled content into the media-type-supported attribute, embedding a FoomaticRIPCommandLine directive and cupsFilter entry so the target eventually executes an arbitrary shell command via foomatic-rip. The exploit also supports optionally sending the initial UDP browse/discovery trigger to a target host on port 631, causing cups-browsed to connect back to the rogue IPP server. Payloads are user-supplied at runtime and may be passed directly or loaded from a file, making the exploit flexible but still basic rather than framework-grade. The repository structure is simple: 4 files total, with 2 code files and 2 README files. The main exploit entry point is cups_rce_exploit.cpp. The secondary tool, Cups-Patcher/cups_patcher.cpp, is not an exploit; it is a mitigation utility that disables cups-browsed, edits /etc/cups/cupsd.conf to disable browsing and bind to localhost, adds iptables/ip6tables rules blocking UDP 631, replaces foomatic-rip with a harmless stub, modifies /etc/hosts, creates backups, and supports restore/check/status style operations. This confirms the repository’s overall purpose is both offensive demonstration of the CUPS vulnerability chain and defensive hardening guidance. Notable network observables from the exploit include UDP 631 for the trigger, TCP 631 (or attacker-selected port) for the rogue IPP server, IPP URIs of the form ipp://ATTACKER:PORT/printers/NAME, and device URIs of the form socket://ATTACKER:PORT. Example payload observables in the README include reverse shell traffic to TCP 4444, file writes under /tmp, and retrieval of a second-stage script from http://192.168.1.50/backdoor.sh.

This repository contains a single Metasploit module: 'modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb'. The module exploits several vulnerabilities in OpenPrinting CUPS and related components (cups-browsed, libcupsfilters, libppd, cups-filters) on Linux systems. It allows an attacker on the same LAN to advertise a malicious printer using mDNS (multicast DNS) to the address 224.0.0.251. When a victim sends a print job to this printer, the module delivers a payload via the IPP protocol, resulting in remote code execution as the 'lp' user on the victim's machine. The exploit does not require any open CUPS ports on the victim; only user interaction (sending a print job) is needed. The module references four CVEs (CVE-2024-47076, CVE-2024-47175, CVE-2024-47177, CVE-2024-47176) and is based on public research and exploits. The main attack vector is network-based, leveraging LAN multicast and HTTP/IPP services. The module is operational and allows for customizable payloads via the Metasploit framework.