Get the latest tech news
RCE Vulnerability Discovered in Cups
CUPS disclosure leaked online. Not my report. The original author is @evilsocket - cups-browsed.md
The following report explains how to exploit this in order force the service to write user controlled data to the temporary file and ultimately achieving code execution via network request. Some time ago the cups-filters maintainers took over maintainership of the foomatic-filters part for CUPS as well, and integrated it cleanly into cups- filters. I'm attaching the exploit code, it uses the ippserver package ( [ https://github.com/h2g2bob/ipp-server] ), run as exploit.py ATTACKER_EXTERNAL_IP TARGET_IP, will create the/tmp/I_AM_VULNERABLE file on the target machine when a print job is started:
Or read this on Hacker News