Message-id: <175c118b-0771-425c-bc9d-d7da8ec5f40b@me.com>
Date: Thu, 3 Oct 2024 17:54:15 +0000 (UTC)
From: Larry Cashdollar <larry0@...com>
To: oss-security@...ts.openwall.com
Subject: cups-browsed vulnerable to DDoS amplification attack

Hello, oss-security,

While reading Evilsocket's blog post, I noticed an attack vector that wasn't discussed: DDoS. The problem arises when an attacker sends a crafted packet specifying the address of a target as a printer to be added. For each packet sent, the vulnerable CUPS server generates a larger and partially attacker-controlled IPP/HTTP request directed at the specified target.

As a result, not only is the target affected, but the host of the CUPS server also becomes a victim, as the attack consumes its network bandwidth and CPU resources. A simple script can be used to send the malicious UDP packet to a vulnerable instance of CUPS. The crafted payload directs CUPS to send an IPP/HTTP request to the target and port specified by the attacker.

The vulnerability appears when cups-browsed attempts to fetch the URI specified to download the IPP attributes file. This PPD file URI is somewhat arbitrary and can be modified by the attacker. In testing, we found that this URI payload can be padded out to 989 bytes. This padding is included twice in the IPP/HTTP request: once in the HTTP headers, and again in the POST data that is directed at the targeted system.

By using this padding technique, attackers could further exacerbate the impact of CUPS-supported DDoS attacks, consuming additional bandwidth and resources on the targeted networks and systems. The attacking system only needs to send a single packet to a vulnerable and exposed CUPS service with internet connectivity to cause the system running CUPS to begin the attack.

Updating to the latest CUPS version seems to mitigate this issue for most Linux systems. I’ve requested a CVE ID to differentiate between the RCE and DoS vulnerability.

Attack requests appear like the following in server logs:

x.x.x.x - - [03/Oct/2024:09:58:01 +0000] "POST /printers/ HTTP/1.1" 404 462 "-" "CUPS/2.4.2 (Linux 6.1.0-25-amd64; x86_64) IPP/2.0"

or

x.x.x.x - - [03/Oct/2024:09:58:01 +0000] "POST /classes/ HTTP/1.1" 404 462 "-" "CUPS/2.4.2 (Linux 6.1.0-25-amd64; x86_64) IPP/2.0"

Additional details can be found here:
October CUPS DDoS Threat

Thanks,
Larry Cashdollar