Summary
Today I stumbled upon an Ubuntu system running the legacy-printer-app service. It turns out it runs as root, unauthenticated by default and listen on 0.0.0.0:8000.

After looking at it for a moment I have found that the upload and deletion of PPDs is vulnerable to directory traversal. It can be used to upload a file to any directory in the system AND delete any file too.

I also want to add that by allowing unauthenticated users to upload PPDs, adding printers and triggering printing jobs also allows malicious users to run arbitrary commands in the system through cups filters. All you need to do is upload a PPD that run a command with the cupsFilter setting, add a printer using the driver and print a test page.

Details
To trigger the vulnerability one just need to add ../ to the file name. The filename, for example ../../../../../etc/passwd, will be concatenated with the base directory used to store PPDs without sanitization.

PoC
$ HOST=172.16.0.25:8000
$ token=$(curl ${HOST}/addppd 2>/dev/null | grep 'name="session"' | tail -n 1 | awk '{print $4}' | grep -Eo '".*"' | tr -d '"')
$ curl -d "session=${token}&%09/../../../../../etc/wgetrc=on&action=delete-ppdfiles" http://${HOST}/addppd
Impact
Anyone who can connect to the application through the network can upload malicious files and destroy the system by deleting arbitrary files.
RHEL 10, Centos Stream 10 and Fedora are not affected until the dir /var/lib/legacy-printer-app/ppd is created (which requires root permissions to create that dir), because the dir is not installed by OS due packaging error, so severity for those platform is HIGH (CVSS 7.3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:H) - because root is needed to create the dir.