Loading vulnerability…
CVE-2024-51979 is a stack-based buffer overflow affecting Brother printer web and printing services. According to the provided content, an authenticated attacker can trigger the flaw by sending a malformed request to the HTTP service on TCP/80, HTTPS on TCP/443, or IPP on TCP/631. Exploitation requires an empty Origin header and a malformed Referer header whose host component exceeds the fixed stack buffer used during CSRF-related header validation. The content associates the vulnerable logic with CSRF token validation and specifically notes overflow during processing of the Referer host value, which is copied without adequate bounds checking. Supporting context further references the vulnerable code path as handle_http_request -> decode_params -> decode_csrftoken, where attacker-controlled Referer data is processed into a fixed-size stack buffer.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains proof-of-concept (PoC) exploit scripts for seven vulnerabilities (CVE-2024-51977 through CVE-2024-51983) affecting Brother multifunction printers and related OEM devices. Each exploit is implemented as a standalone Ruby script, targeting a specific CVE. The exploits cover a range of attack types: - CVE-2024-51977: Leaks sensitive information from the printer via unauthenticated HTTP(S)/IPP request to /etc/mnt_info.csv. - CVE-2024-51978: Allows an unauthenticated attacker to generate the device's default administrator password, either by leaking the serial number or by providing it directly. - CVE-2024-51979: Authenticated stack-based buffer overflow via crafted HTTP requests, potentially leading to code execution or denial of service. - CVE-2024-51980: Unauthenticated SSRF/port scan via SOAP requests, allowing the attacker to force the printer to open TCP connections to arbitrary internal hosts/ports. - CVE-2024-51981: Unauthenticated SSRF, forcing the device to perform arbitrary HTTP requests to internal or external hosts. - CVE-2024-51982: Unauthenticated device crash via malformed PJL commands sent over TCP port 9100. - CVE-2024-51983: Unauthenticated device crash via crafted SOAP requests to the printer's web services endpoint. The repository also includes a ReadMe.md with detailed descriptions, affected models, and usage instructions, as well as a simple Sinatra server (sinatra_server.rb) for testing SSRF payloads. All scripts are written in Ruby and require minimal dependencies (primarily 'httparty'). The exploits are PoC-level and focus on demonstrating the vulnerabilities rather than providing weaponized payloads. The main attack vector is network-based, targeting exposed printer services over HTTP, HTTPS, IPP, and PJL.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A stack-based buffer overflow in CSRFToken header validation referenced as inspiration for the researchers’ analysis.
A stack-based buffer overflow in CSRFToken header validation referenced as inspiration for the researchers’ analysis, not the primary flaw exploited in this printer chain.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.