mirror of
https://github.com/elastic/protections-artifacts
synced 2026-06-08 14:02:19 +00:00
protectionsmachine
59 lines
1.9 KiB
TOML
59 lines
1.9 KiB
TOML
[rule]
|
|
description = """
|
|
This detection rule addresses multiple vulnerabilities in the CUPS printing system, including CVE-2024-47176,
|
|
CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. Specifically, this rule detects shell executions from the
|
|
foomatic-rip parent process. These flaws impact components like cups-browsed, libcupsfilters, libppd, and foomatic-rip,
|
|
allowing remote unauthenticated attackers to manipulate IPP URLs or inject malicious data through crafted UDP packets or
|
|
network spoofing. This can result in arbitrary command execution when a print job is initiated.
|
|
"""
|
|
id = "8ccebdc1-9929-4584-ac8f-a96ee8e8c616"
|
|
license = "Elastic License v2"
|
|
name = "Foomatic-rip Shell Execution"
|
|
os_list = ["linux"]
|
|
reference = [
|
|
"https://www.elastic.co/security-labs/cups-overflow",
|
|
"https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/",
|
|
"https://gist.github.com/stong/c8847ef27910ae344a7b5408d9840ee1",
|
|
"https://github.com/RickdeJager/cupshax/blob/main/cupshax.py",
|
|
]
|
|
version = "1.0.5"
|
|
|
|
query = '''
|
|
process where event.type == "start" and event.action == "exec" and process.parent.name == "foomatic-rip" and
|
|
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and not (
|
|
process.command_line like (
|
|
"*/tmp/foomatic-*", "*-sDEVICE=ps2write*", "*printf*", "/bin/sh -e -c cat", "/bin/bash -c cat",
|
|
"/bin/bash -e -c cat", "/bin/sh -e -c pdftops*"
|
|
) or
|
|
process.args like "gs*"
|
|
)
|
|
'''
|
|
|
|
min_endpoint_version = "7.15.0"
|
|
optional_actions = []
|
|
[[actions]]
|
|
action = "kill_process"
|
|
field = "process.entity_id"
|
|
state = 0
|
|
|
|
[[actions]]
|
|
action = "kill_process"
|
|
field = "process.parent.entity_id"
|
|
state = 0
|
|
|
|
[[threat]]
|
|
framework = "MITRE ATT&CK"
|
|
[[threat.technique]]
|
|
id = "T1203"
|
|
name = "Exploitation for Client Execution"
|
|
reference = "https://attack.mitre.org/techniques/T1203/"
|
|
|
|
|
|
[threat.tactic]
|
|
id = "TA0002"
|
|
name = "Execution"
|
|
reference = "https://attack.mitre.org/tactics/TA0002/"
|
|
|
|
[internal]
|
|
min_endpoint_version = "7.15.0"
|