# Cups Overflow: When your printer spills more than Ink

Unauthenticated attacker advertises a rogue IPP printer via mDNS/UDP 631; crafted attributes inject FoomaticRIPCommandLine into a PPD, yielding RCE as lp when a print job runs.

- Payout: Research
- Severity: critical
- Program: CUPS
- Credited: Mika Ayenson,Terrance DeJesus,Eric Forte,Ruben Groenewoud
- Disclosed: 2024-09-28
- CVE: CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, CVE-2024-47177
- Write-up quality: 6/10
- Original: https://www.elastic.co/security-labs/threat-command/cups-overflow
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-cups-overflow
- Tags: domain:infra impact:rce kind:research platform:threat-intel sev:critical tech:linux technique:chained technique:recon vuln:command-injection vuln:rce

**Target:** cups-browsed / libcupsfilters / libppd / foomatic-rip on UNIX
**Root cause:** cups-browsed accepts unauthenticated DNS-SD/IPP advertisements and libcupsfilters/libppd fail to validate IPP attributes, which get written into PPD files; the legacy FoomaticRIPCommandLine directive then executes arbitrary commands.
**Steps:**
1. Run cupshax PoC: registers fake IPP printer via mDNS/ZeroConf and listens for IPP requests.
2. Victim cups-browsed receives broadcast on UDP 631 and requests printer attributes from attacker URL.
3. PoC replies with IPP attributes containing `FoomaticRIPCommandLine` payload.
4. Victim generates and saves a PPD file from the malicious attributes.
5. User sends a print job to the rogue printer; foomatic-rip executes the command as user `lp`.
6. Payload downloads/compiles/executes remote binary or spawns reverse shell (non-interactive due to no login shell).
**How found:** Elastic reviewed leaked @evilsocket PoC and cupshax PoC; noted foomatic-rip spawning shells and lp-user file writes as anomalous telemetry, then built detections around parent/child process behavior.
**Exploitation:** Attacker broadcasts spoofed DNS-SD/mDNS printer advertisement over LAN or WAN UDP 631; victim auto-registers printer, fetches attributes, writes malicious PPD; on print job foomatic-rip runs FoomaticRIPCommandLine as lp, enabling reverse shell or remote payload download/execution.
**Escalation:** Chained four CVEs; can silently replace existing printers or install new ones; combined with spear-phishing to coerce printing.
**Insight:** Legacy filter directives like FoomaticRIPCommandLine remain unpatched for a decade; when auditing print stacks, trace how remote-supplied IPP attributes flow into PPD generation and which filter directives execute commands.