Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-35235— Cupsd Listen arbitrary chmod 0140777

Quick assessment

Affected
OpenPrinting cups
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenPrinting CUPS是OpenPrinting公司的一个适用于 Linux® 和其他类 Unix® 操作系统的基于标准的开源打印系统。 OpenPrinting CUPS 2.4.8 及之前版本存在安全漏洞，该漏洞源于当使用指向符号链接的 Listen 配置项启动 cupsd 服务器时，会导致 cupsd 进程对所提供参数执行任意 chmod，从而为目标提供可全局写入的访问权限。

CVSS 4.4 · Medium EPSS 2.42% · P84
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-35235

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Cupsd Listen arbitrary chmod 0140777
Source: CVE Program / CVE List V5
Vulnerability Description
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can be caused to perform an arbitrary chmod of the provided argument, providing world-writable access to the target. Given that cupsd is often running as root, this can result in the change of permission of any user or system files to be world writable. Given the aforementioned Ubuntu AppArmor context, on such systems this vulnerability is limited to those files modifiable by the cupsd process. In that specific case it was found to be possible to turn the configuration of the Listen argument into full control over the cupsd.conf and cups-files.conf configuration files. By later setting the User and Group arguments in cups-files.conf, and printing with a printer configured by PPD with a `FoomaticRIPCommandLine` argument, arbitrary user and group (not root) command execution could be achieved, which can further be used on Ubuntu systems to achieve full root command execution. Commit ff1f8a623e090dee8a8aadf12a6a4b25efac143d contains a patch for the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在文件访问前对链接解析不恰当(链接跟随)
Source: CVE Program / CVE List V5
Vulnerability Title
OpenPrinting CUPS 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OpenPrinting CUPS是OpenPrinting公司的一个适用于 Linux® 和其他类 Unix® 操作系统的基于标准的开源打印系统。 OpenPrinting CUPS 2.4.8 及之前版本存在安全漏洞，该漏洞源于当使用指向符号链接的 Listen 配置项启动 cupsd 服务器时，会导致 cupsd 进程对所提供参数执行任意 chmod，从而为目标提供可全局写入的访问权限。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
OpenPrinting cups <= 2.4.8 -

II. Public POCs for CVE-2024-35235

# POC Description Source Link Shenlong Link
1 exp of CVE-2024-35235&CVE-2024-5290 https://github.com/zrax-x/CVE-2024-35235-CVE-2024-5290-exp POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-35235

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-35235 (1)

Mailing List Discussions for CVE-2024-35235 (3)

Other References for CVE-2024-35235 (2)

IV. Related Vulnerabilities

Same product: cups
Same vendor: OpenPrinting
Same weakness: CWE-59

V. Comments for CVE-2024-35235

No comments yet

Leave a comment