CVE-2024-47175: Openprinting Libppd RCE Vulnerability

CVE-2024-47175 Overview

CVE-2024-47175 is a critical input validation vulnerability in OpenPrinting's libppd library, which provides legacy PPD (PostScript Printer Description) file support for the CUPS printing system. The vulnerability exists in the ppdCreatePPDFromIPP2 function, which fails to properly sanitize IPP (Internet Printing Protocol) attributes when creating PPD buffers. When combined with other functions such as cfGetPrinterAttributes5, this flaw allows attackers to inject malicious content that can ultimately lead to arbitrary code execution via the Foomatic printing system.

This vulnerability is particularly dangerous as it can be chained with CVE-2024-47176 to form a complete remote code execution (RCE) exploit chain targeting UNIX-based systems running vulnerable CUPS printing services.

Critical Impact
Unauthenticated attackers can achieve remote code execution on vulnerable systems by exploiting the input validation flaw in libppd's PPD buffer generation, potentially compromising print servers and connected infrastructure.

Affected Products

OpenPrinting libppd (versions prior to the security patch)
OpenPrinting libppd 2.1 beta1
Debian Linux 11.0

Discovery Timeline

2024-09-26 - CVE-2024-47175 published to NVD
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-47175

Vulnerability Analysis

The vulnerability resides in the ppdCreatePPDFromIPP2 function within the libppd library. This function is responsible for converting IPP printer attributes into PPD format for backward compatibility with legacy printing applications. The core issue is that the function accepts IPP attributes without proper validation or sanitization, allowing attacker-controlled data to be embedded directly into the generated PPD buffer.

When a malicious actor crafts specially formatted IPP responses containing malicious payloads, these payloads pass through the buffer generation process unfiltered. The Foomatic printing system, which processes these PPD files, can then execute arbitrary commands embedded in the malicious content. This attack becomes particularly effective when combined with the cfGetPrinterAttributes5 function, which retrieves printer attributes from potentially untrusted sources.

The attack chain leverages the trust relationship between CUPS components, where the printing subsystem assumes that IPP responses are well-formed and originate from legitimate printer devices.

Root Cause

The root cause of CVE-2024-47175 is improper input validation (CWE-20) in the ppdCreatePPDFromIPP2 function. The function directly incorporates IPP attribute values into the PPD buffer without checking for or escaping potentially dangerous characters or command sequences. This oversight allows injection of malicious content that can be interpreted as executable commands by downstream components in the printing pipeline.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

Spoofing or compromising a network printer or print service
Sending malicious IPP responses containing crafted attribute values
The vulnerable libppd function incorporates these values into PPD buffers
When processed by Foomatic or similar components, the malicious payload executes

The following patch demonstrates the security fix applied to prevent PPD generation based on invalid IPP responses:

 //
 // PPD cache implementation for libppd.
 //
+// Copyright © 2024 by OpenPrinting
 // Copyright © 2010-2019 by Apple Inc.
 //
 // Licensed under Apache License v2.0.  See the file "LICENSE" for more

Source: GitHub Commit for libppd Update

Detection Methods for CVE-2024-47175

Indicators of Compromise

Unusual network traffic to UDP port 631 (CUPS/IPP) from external or unexpected sources
Suspicious PPD files with embedded shell commands or unusual content in printer configurations
Unexpected processes spawned by the cupsd or Foomatic-related services
Log entries indicating printer discovery or registration from unknown IP addresses

Detection Strategies

Monitor CUPS and IPP-related network traffic for malformed or suspicious attribute values
Implement network segmentation to isolate printing services from untrusted networks
Deploy endpoint detection rules to identify command execution attempts originating from printing subsystems
Audit system logs for unexpected printer registrations or PPD file modifications

Monitoring Recommendations

Enable verbose logging for CUPS and related printing services to capture IPP transaction details
Configure intrusion detection systems (IDS) to alert on suspicious IPP traffic patterns
Monitor for processes with unusual parent-child relationships involving CUPS components
Implement file integrity monitoring on PPD directories and printer configuration files

How to Mitigate CVE-2024-47175

Immediate Actions Required

Update libppd to the patched version immediately on all affected systems
Disable or restrict network access to the CUPS service (port 631) if not required
Block incoming UDP traffic on port 631 from untrusted networks at the firewall level
Review and remove any untrusted or automatically discovered printer configurations

Patch Information

OpenPrinting has released a security patch addressing this vulnerability. The fix is available via GitHub Commit d681747ebf12602cb426725eb8ce2753211e2477. Detailed information about the vulnerability and remediation steps can be found in the GitHub Security Advisory GHSA-7xfx-47qg-grp6.

For Debian Linux 11.0 users, refer to the Debian LTS Announcement for distribution-specific update instructions.

Workarounds

Disable the cups-browsed service to prevent automatic printer discovery from untrusted sources
Configure firewall rules to block UDP port 631 from external networks
Implement network segmentation to isolate print servers from general network traffic
Manually configure only trusted printers and disable automatic printer discovery features

bash

# Disable cups-browsed service to prevent automatic printer discovery
sudo systemctl stop cups-browsed
sudo systemctl disable cups-browsed

# Block external access to CUPS service
sudo ufw deny from any to any port 631