CUPS RCE Vulnerabilities (CVE-2024-47176-47177) – Patch and Detect Now

What happened

On 26 September 2024, researcher Simone Margaritelli disclosed a chain of critical vulnerabilities in the CUPS printing system (cups-browsed, libscupsfilters, libppd) that allow unauthenticated remote code execution via the Internet Printing Protocol and mDNS on UDP port 631. The flaws, identified as CVE-2024-47176, CVE-2024-47076, CVE-2024-47175 and CVE-2024-47177, affect all CUPS releases up to 2.0.1 and are present on GNU/Linux, BSD, ChromeOS and Solaris distributions that enable cups-browsed by default.

Impact

Attackers can send crafted IPP or mDNS packets from the public internet or a local network to trigger arbitrary code execution on the target host. The vulnerability chain includes the legacy foomatic-rip filter, which still permits execution of arbitrary commands via the FoomaticRIPCommandLine directive. A successful exploit can give the attacker full control of the affected system.

What defenders should do

• Patch CUPS to the latest release (>=2.0.2) or apply vendor‑issued patches.
• Disable cups-browsed if the service is not required, or restrict it to trusted networks.
• Block inbound UDP traffic on port 631 or restrict it to internal interfaces.
• Deploy Elastic Security’s new pre‑built detection rules (Stack 8.15+, 8.14+, 8.13+, 8.12+) to flag suspicious IPP/mDNS activity.
• Monitor logs for unexpected IPP requests, malformed packets, or repeated failures on port 631.

Detection and Mitigation

Elastic Security Labs has released out-of-the-box rules that detect exploitation attempts against the affected CUPS components. Update your Prebuilt Security Detection Rules integration to the latest package version (8.15.6+ for Stack 8.15, 8.14.12+ for Stack 8.14, 8.13.18+ for Stack 8.13, 8.12.23+ for Stack 8.12) and verify that the rules are active. Combine rule alerts with network filtering and patching for a layered defense.