CVE-2024-47850: CUPS cups-browsed DoS Vulnerability

CVE-2024-47850 Overview

CVE-2024-47850 is a high-severity vulnerability in CUPS cups-browsed before version 2.5b1 that enables DDoS amplification attacks. The flaw allows an attacker to send a single IPP UDP packet requesting a printer to be added, which triggers the vulnerable service to send an HTTP POST request to an arbitrary destination and port. While this functionality was originally designed to probe new printers, attackers can exploit it to create powerful DDoS amplification attacks against third-party targets.

Critical Impact

Attackers can weaponize vulnerable CUPS installations to generate amplified DDoS traffic against arbitrary targets by sending minimal UDP packets, potentially causing significant network disruption and service outages.

Affected Products

• CUPS cups-browsed versions before 2.5b1
• Linux and Unix systems running vulnerable cups-browsed service
• Network-exposed printing infrastructure with IPP UDP enabled

Discovery Timeline

• October 4, 2024 - CVE-2024-47850 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-47850

Vulnerability Analysis

This vulnerability (CWE-400: Uncontrolled Resource Consumption) exists in the cups-browsed daemon, which is responsible for discovering network printers using various protocols including IPP (Internet Printing Protocol). The core issue stems from the service's handling of incoming IPP UDP packets that request printer additions.

When cups-browsed receives a crafted UDP packet on the IPP port, it automatically initiates an HTTP POST request to probe the supposed new printer. The critical flaw is that the destination address and port for this outbound request are derived from attacker-controlled input without adequate validation. This behavior can be exploited to redirect amplified traffic to arbitrary targets.

The amplification factor makes this vulnerability particularly dangerous for DDoS attacks. A small UDP packet from the attacker can trigger a significantly larger HTTP POST request from the vulnerable system, multiplying the attack traffic. When combined with a large number of vulnerable CUPS installations, this creates a substantial amplification vector.

This vulnerability is distinct from CVE-2024-47176, though both relate to the CUPS printing system and IPP handling.

Root Cause

The root cause is improper validation of destination addresses in the printer probing functionality. The cups-browsed service trusts the address information contained in incoming IPP UDP packets and uses it directly to construct outbound HTTP POST requests. This allows attackers to specify arbitrary destination addresses, effectively turning vulnerable CUPS installations into DDoS reflectors.

Attack Vector

The attack exploits the network-accessible IPP UDP service running on vulnerable systems. An attacker crafts a malicious IPP UDP packet containing a target victim's IP address and port, then sends it to vulnerable cups-browsed instances. Each vulnerable system responds by sending HTTP POST requests to the attacker-specified target, creating an amplification effect.

The attack requires no authentication or user interaction, and can be executed remotely across the network. By targeting multiple vulnerable CUPS installations simultaneously, attackers can generate substantial DDoS traffic against their chosen victim. The reflected nature of the attack also obscures the true origin of the malicious traffic.

Detection Methods for CVE-2024-47850

Indicators of Compromise

• Unusual outbound HTTP POST traffic originating from the cups-browsed process to non-printer IP addresses
• High volume of incoming UDP packets on IPP port (631/UDP) from external sources
• Unexpected network connections from printing infrastructure to external hosts
• Log entries showing printer probe requests for suspicious or non-existent printer addresses

Detection Strategies

• Monitor outbound HTTP traffic from cups-browsed for connections to unexpected destinations
• Implement network flow analysis to detect amplification patterns (small inbound UDP, large outbound HTTP)
• Deploy IDS/IPS rules to identify malformed or suspicious IPP UDP packets
• Audit cups-browsed logs for anomalous printer discovery requests

Monitoring Recommendations

• Configure network monitoring to alert on high-volume outbound HTTP POST requests from print servers
• Track UDP traffic statistics on port 631 to identify potential exploitation attempts
• Implement rate limiting on IPP UDP responses to reduce amplification effectiveness
• Use SentinelOne network visibility features to monitor cups-browsed network behavior

How to Mitigate CVE-2024-47850

Immediate Actions Required

• Upgrade CUPS cups-filters to version 2.5b1 or later immediately
• Disable cups-browsed service if network printer discovery is not required
• Implement firewall rules to block incoming UDP traffic on port 631 from untrusted networks
• Isolate print infrastructure from direct internet exposure

Patch Information

The vulnerability is addressed in CUPS cups-filters version 2.5b1 and later. Organizations should upgrade to the patched version as soon as possible. For detailed patch information, refer to the GitHub Security Advisory GHSA-rq86-c7g6-r2h8 and the NetApp Security Advisory.

Additional technical analysis of the DDoS threat is available in the Akamai Blog DDoS Threat Analysis.

Workarounds

• Block inbound UDP port 631 at perimeter firewalls to prevent external exploitation
• Disable the cups-browsed service entirely if automatic printer discovery is not needed
• Configure cups-browsed to only accept connections from trusted local networks
• Implement egress filtering to limit unexpected outbound HTTP connections from print servers

# Disable cups-browsed service to mitigate exploitation
sudo systemctl stop cups-browsed
sudo systemctl disable cups-browsed

# Block inbound IPP UDP traffic from external networks
sudo iptables -A INPUT -p udp --dport 631 -j DROP

# Alternatively, allow only from trusted local network
sudo iptables -A INPUT -p udp --dport 631 -s 192.168.1.0/24 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 631 -j DROP