CVE-2024-47176 — CUPS RCE Exploit Lab

CyberSecurity & Virtualisation 2025-2026

Isolated lab environment to demonstrate CVE-2024-47176 (CUPS Remote Code Execution via cups-browsed).

Setup

Required VDIs

• Ubuntu 22.04 (NOT 24.04!) — https://www.osboxes.org/ubuntu/ → VirtualBox (VDI)
• Kali Linux 2026.1 — https://cdimage.kali.org/kali-2026.1/kali-linux-2026.1-virtualbox-amd64.7z

Unzip both VDIs and place them in VMs/ubuntu/ and VMs/kali-linux-2026.1-virtualbox-amd64/

Deployment (Windows, PowerShell as Admin)

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
.\create_vms.ps1

Provisioning on VMs

# Ubuntu 22.04
sudo bash /mnt/shared/setup_target.sh

# Kali Linux
sudo bash /mnt/shared/setup_kali.sh

Credentials: osboxes/osboxes.org (Ubuntu), kali/kali (Kali)

Network

• Host-Only: 192.168.56.0/24
• Ubuntu Target: 192.168.56.101 (CUPS on port 631)
• Kali Attacker: 192.168.56.102
• SSH available on both VMs (port 22)

Quick Verification

ping 192.168.56.101
nmap -sU -p 631 192.168.56.101
ssh [email protected]

Vulnerability Chain

Status: Printer registration and PPD injection work. Command execution does not trigger because CUPS does not execute filters for remote printers from cups-browsed.