Other nomination

Local DoS on CUPS to a remote exploit via specially-crafted webpage

Adrian Pastor

pagvac uses the browser as a bridge to a localhost-only daemon: cupsd runs as root on default Ubuntu Desktop and listens on 127.0.0.1:631, and a web page writing 101 image tags at its add-rss-subscription endpoint crashes it reliably, with no CUPS authentication on 8.04. Includes the crash PoC, a bash cleanup script, and the argument that root-owned local services are remotely reachable via CSRF.

Record

Researcher

Adrian Pastor

In the archive

• Nominated for the 2008 Top 10 Web Hacking Techniques

Related sources

• CUPS 0day project

Tags

• csrf
• dos
• privilege-escalation
• case-study
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Adrian Pastor, first published at the original source. Preserved copies are kept so the citation survives its host.