Today, we have released a brand new lab on the remote code execution vulnerability affecting the CUPS service. Come see how to defend against this attack and the indicators of compromise it creates!
You may have heard all the hype about the latest Linux RCE that was supposed to be released on the 6th October. It got leaked and released early! At the actual time of release, there was no active patch; however, a few hours later, there was a patch sent out. The researcher who released it says it is a 9.9 in CVSS (meaning terrifying), but at Immersive Labs, we have likened it more to around 6.8. While the hype is not worth it for this particular vulnerability, there are 300,000 exposed machines on the internet that could be affected by this.
What is CVE-2024-47177 – CUPS RCE?
It is based on a vulnerability from over a decade ago that was accidentally reintroduced when porting code to a new repository. It takes advantage of the CUPS service, which is Linux's way of printing! There is a default service open to the world running on port 631, meaning anyone can connect and begin this attack. The full RCE is a bit more nuanced as it requires some interaction by a user, but it is still worth knowing due to the hype it has caused.
Why should you care?
Due to its low complexity and potential reach, this vulnerability might worry our customers who use many Ubuntu Desktops in their business networks. Therefore, we have created a lab on how to threat hunt for this vulnerability and the logging that gets produced once the exploit has been successfully executed.
Who is it for?
- Incident responders
- SOC analyst
- Malware reverse engineers
- CTI Analysts
- Threat Hunters
Complete the CUPS Remote Code Execution Vulnerability Lab here
Immerser
