Exploit for Improper Authentication in Openprinting Cups

> **Authorized testing / research use only.** Run this PoC only against systems you own or are explicitly authorized to test.

This repository contains a system-CUPS-oriented reproduction of the local-printer vulnerability in **CUPS 2.4.16**.

The implementation was developed from the published CUPS vulnerability reproduction and adapted to work against an **already-running system CUPS installation**, rather than requiring a separately installed CUPS build and a root-run reproduction harness.

The reproduction follows this general chain:

The exploit is race-dependent, so successful execution is not guaranteed on every attempt.

The published reproduction is designed as a controlled vulnerability harness. In particular, it assumes a dedicated CUPS installation and performs setup/reset operations that are appropriate for a reproduction environment but are not representative of an already-running distribution installation.

- Uses the system's existing CUPS service.

- Uses the system `cups-create-local-printer.test` definition when available.

- Captures the CUPS `Local` authorization token.

- Reuses that token for authenticated IPP administration.

- Reproduces the local-printer / `file://` primitive.

- Performs the printer/job sequence used by the reproduction.

- Treats the final privilege check as the success condition.

/usr/ /cups/ipptool/cups-create-local-printer.test

find /usr/ /cups -name 'cups-create-local-printer.test' 2>/dev/null

Configure the attacker identity and target path through environment variables:

export CUPS_TARGET="/tmp/cups-poc-target"

For a controlled privilege-escalation reproduction, choose a target appropriate to your isolated test environment.

The script also defaults to a sudoers-style target under `/etc/sudoers.d/`, so **do not run it casually on a production system**.

The PoC starts an IPP listener and causes CUPS to authenticate against it. The listener initially returns a `401` challenge with:

The token is then reused against the local CUPS administration endpoint.

The candidate loop performs the printer operations repeatedly, including:

The race is intentionally repeated because a single attempt may not win.

## Relationship to the published reproduction

This repository is an **adaptation**, not the canonical upstream implementation.

The request-building logic and exploitation sequence are based on the published reproduction. The main changes are around running against an existing system CUPS installation and removing reproduction-environment setup/reset assumptions.

See the upstream OpenPrinting CUPS security advisory and repository for the authoritative vulnerability information and original reproduction.

- Distribution-specific CUPS configuration may affect behavior.

- File permissions and AppArmor/other confinement can change the result.

- A successful token disclosure does not by itself imply successful privilege escalation.

- The PoC has only been validated in the author's controlled lab environment.

Do not use this against CUPS installations without authorization.

For defensive validation, the useful indicators include unexpected IPP requests to attacker-controlled endpoints, unusual `Local` authentication exchanges, creation of unexpected local printers, and suspicious printer/job activity.