CISA Adds 3 Actively Exploited Flaws to KEV Catalog, including Critical PaperCut Bug

An integer overflow (CWE-190) in Skia, the 2D graphics library used by Chrome's renderer, can be triggered by a crafted HTML page whose content drives Skia processing past the limits of its integer math. A remote attacker who has already compromised the Chrome renderer process — for example through a separate renderer flaw or a malicious page — can leverage the overflow to escape Chrome's renderer sandbox and gain broader code execution on the host. All Google Chrome and Chromium users running versions prior to 112.0.5615.137 are affected, including Chromium packages shipped by Debian and Fedora. The flaw is rated Critical (CVSS 3.1: 9.6) and carries Chromium security severity High, with an EPSS probability of 5.7% (93rd percentile) of exploitation within 30 days. It was added to CISA's Known Exploited Vulnerability catalog on 2023-04-21, and news reports describe it as an actively exploited Chrome zero-day for which Google rushed out the 112.0.5615.137 patch.

Do: Update Google Chrome to 112.0.5615.137 or later on all platforms, and install the corresponding Chromium security updates on Debian and Fedora systems. Because exploitation requires user interaction with a crafted page plus a pre-existing renderer compromise, prompt patching is the primary mitigation; verify via CISA KEV required actions that all managed browsers are updated and confirm Chrome versions in endpoint inventory.

PaperCut MF and PaperCut NG print management software contain an improper access control flaw (CWE-284) in the SetupCompleted class that allows an unauthenticated attacker to bypass authentication and reach internal administrative functionality. The flaw is triggered by sending crafted, unauthenticated requests to the PaperCut application's web interface, without requiring valid user credentials. A successful attacker gains the ability to execute code in the context of the SYSTEM account on the PaperCut server, typically a Windows print server, giving full control of that host. Any organization running PaperCut MF or NG is potentially affected, and exposure is highest where the server's web interface is reachable from the internet or by untrusted networks. Exploitation is confirmed in the wild: CISA added the flaw to the KEV on 2023-04-21 with known ransomware use, and EPSS rates exploitation probability at 100% within 30 days.

Do: Apply the vendor's updates as instructed (this is the required action in CISA KEV) — upgrade PaperCut MF/NG to the patched releases listed in PaperCut's security advisory rather than relying on unpatched installs. Until patched, restrict network access to the PaperCut web/admin interface so it is reachable only from trusted hosts, and check the server for signs of compromise given known ransomware use. Prioritize internet-facing PaperCut servers, which public scans show are exposed in the thousands.

MinIO, a Multi-Cloud Object Storage framework, exposes its entire set of environment variables in distributed (cluster) deployments running RELEASE.2019-12-17T23-16-33Z or later but prior to RELEASE.2023-03-20T20-16-18Z: an unauthenticated POST request to the cluster bootstrap endpoint (/cluster?bootstrap) on the MinIO API port (default 9000) returns secrets including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD. An attacker with network access to that port needs no privileges or user interaction (CVSS 3.1: AV:N/AC:L/PR:N, 7.5 high), and with the retrieved root credentials gains full administrative control over the stored objects; the publicly shared 'Evil_MinIO' exploit demonstrates the disclosure can be chained into full server compromise. Only distributed/cluster deployments are affected; the flaw is classified as CWE-200 information disclosure. The bug is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-04-21, EPSS ranks it in the 100th percentile with an 84% probability of exploitation within 30 days, and attacks on MinIO servers using the Evil_MinIO exploit have been reported.

Do: Upgrade distributed MinIO clusters to RELEASE.2023-03-20T20-16-18Z or later per the vendor advisory and the CISA KEV required action, and restrict untrusted network access to the MinIO API port (default 9000). Because the flaw leaks the entire environment, rotate MINIO_ROOT_PASSWORD/MINIO_SECRET_KEY and any other credentials passed via environment variables, and review logs for suspicious POST /cluster?bootstrap requests or unexpected logins.