[robo2000]

Much appreciated!

[ultra21]

• connect to a malicious IPP server via discovery (cups-browsed): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CWE-940
  https://github.com/OpenPrinting/cups-bro...ed.c#L3994
  
• Returning malicious IPP attributes (cups-browsed, libppd): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N - CWE-20
  https://github.com/OpenPrinting/cups-bro...ed.c#L8628
  https://github.com/OpenPrinting/libppd/b...tor.c#L353
  
• Command execution (cups-browsed, cups-filters): 9.9 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L - CWE-94
  https://github.com/OpenPrinting/cups-bro...ed.c#L8939
  https://github.com/OpenPrinting/cups-fil...rip.c#L983
  

wow amazing research

Thank you for share!

[izkou]

Thanks for the info

[Clumsily9344]

We need to investigate into this.

[PrioritySeat]

Multiple vulns, still need someone to print to the fake printer you setup to finish the RCE from what I can see.

Setting up a few printers like Print to PDF & Print Preview might be a way to trick people in to that part

[theunknown0]

thanks a lot for sharing!

[danzel]

Cool, thanks for the update

[skywalker_28]

nice job dude some RCE stuff

[shallowfrank]

Thanks for sharing, it's amazing to get such information in advance.

[akdop]

amazing!!! how did you do it, hahaa