[feisty] CSRF allows test page printing

Thanks for taking the time to report this bug and helping to make Ubuntu better. With which version of cupsys and Ubuntu did you notice this? Thanks in advance.

On 4/13/07, Brian Murray <email address hidden> wrote:
> With which version of cupsys and Ubuntu did you notice this?

ubuntu feisty (as the subject line says...), cupsys version 1.2.8-0ubuntu8.

Amnon

Please elaborate about this. By default, cupsd only listens on localhost. Local users can do printing operations much easier.

On top of that, administrative operations are restricted to localhost:

  # Restrict access to the admin pages...
  <Location /admin>
    Order allow,deny
    Allow localhost
  </Location>

If you manually enable cupsd to listen on all ports (as gnome-cups-manager's 'Share printer' menu option), remote printing is probably exactly what you want. :)

So, what is the vulnerability here?

On 4/16/07, Martin Pitt <email address hidden> wrote:
> Please elaborate about this. By default, cupsd only listens on
> localhost. Local users can do printing operations much easier.

cupsd listens on localhost but remote web pages can make the browser
access it, , as in the example above. Note that the remote web server
doesn't contact cupsd, the locally running web browser does, without
user intervention.

Even if you enable cupsd to listen on all ports, you probably don't
want remote web pages to execute commands which require
authentication, but AFAIK this attack can also work for this commands
since the browser will send the credentials if they're cached.

This can be considered a simple case of CSRF
(http://en.wikipedia.org/wiki/Csrf).

BTW, I'm not sure if the URL always contains the printer's model (as
in my configuration) or some other simple name. To reproduce the bug
you may have to browse first to localhost:631 and copy the URL for a
command into the html code. (The remote attacker doesn't have to do
this if he can guess the URL).

Yes, this is a design flaw in how CUPS handles its URLs. As described, I think this is a only a minor issue, since the printer name must be known, and no attacker-input is used (it prints the pre-configured test page, and not text that the attacker can control). However, further investigation into CUPS is needed, in case there are additional vectors.

Hardy has reached end of life, and this package is not present in later releases. Closing all related bugs.