PaperCut fixes bug that can lead to RCE, patch quickly! (CVE-2023-39143)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-27350 | Authentication Bypass Leading to SYSTEM RCE in PaperCut MF/NG PaperCut MF and PaperCut NG print management software contain an improper access control flaw (CWE-284) in the SetupCompleted class that allows an unauthenticated attacker to bypass authentication and reach internal administrative functionality. The flaw is triggered by sending crafted, unauthenticated requests to the PaperCut application's web interface, without requiring valid user credentials. A successful attacker gains the ability to execute code in the context of the SYSTEM account on the PaperCut server, typically a Windows print server, giving full control of that host. Any organization running PaperCut MF or NG is potentially affected, and exposure is highest where the server's web interface is reachable from the internet or by untrusted networks. Exploitation is confirmed in the wild: CISA added the flaw to the KEV on 2023-04-21 with known ransomware use, and EPSS rates exploitation probability at 100% within 30 days. Do: Apply the vendor's updates as instructed (this is the required action in CISA KEV) — upgrade PaperCut MF/NG to the patched releases listed in PaperCut's security advisory rather than relying on unpatched installs. Until patched, restrict network access to the PaperCut web/admin interface so it is reachable only from trusted hosts, and check the server for signs of compromise given known ransomware use. Prioritize internet-facing PaperCut servers, which public scans show are exposed in the thousands. | 9.8 | 100% | KEV ransomware PoC ×3 |
| masstens of thousands of organizations (~70k+) and millions of users; thousands of internet-exposed PaperCut servers | |
| CVE-2023-3486 | An authentication bypass exists in PaperCut NG versions 22.0.12 and prior that could allow a remote, unauthenticated attacker to upload arbitrary files to the P An authentication bypass exists in PaperCut NG versions 22.0.12 and prior that could allow a remote, unauthenticated attacker to upload arbitrary files to the PaperCut NG host’s file storage. This could exhaust system resources and prevent the service from operating as expected. NVD description · AI analysis pending | 7.5 | 79% |
| — | ||
| CVE-2023-39143 | PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. This leads to remote code execution when external device integration is enabled (a very common configuration). NVD description · AI analysis pending | 9.8 | 81% | PoC |
| — |
Full article346 words · extracted from helpnetsecurity.com · click to collapse
Horizon3.ai researchers have published some details (but no PoC for now, thankfully!) about CVE-2023-39143, two vulnerabilities in PaperCut application servers that could be exploited by unauthenticated attackers to execute code remotely.
But, they noted, unlike the PaperCut vulnerability (CVE-2023-27350) recently leveraged by Clop and LockBit ransomware affiliates, CVE-2023-39143 is not a “one-shot” RCE bug.
“CVE-2023-39143 is more complex to exploit, involving multiple issues that must be chained together to compromise a server,” they pointed out.
About CVE-2023-39143
PaperCut NG and MF are widely used print management server software solutions.
CVE-2023-39143 are path traversal vulnerabilities in PaperCut NG and PaperCut MF versions released before v22.1.3, which could be used to read, delete, and upload arbitrary files to a vulnerable application server.
“The vulnerability affects PaperCut servers running on Windows. File upload leading to remote code execution is possible when the external device integration setting is enabled. This setting is on by default with certain installations of PaperCut, such as the PaperCut NG Commercial version or PaperCut MF,” the researchers shared.
Mitigating the risk of exploitation
CVE-2023-39143 has been fixed in late July, with the release of PaperCut NG and PaperCut MF 22.1.3.
That particular release also plugged a potential DoS vulnerability (CVE-2023-3486) flagged by Tenable researchers and an escalation of privileges issue (currently without CVE) found by Trend Micro researchers in a third-party dependency used by PaperCut.
Other security improvements were made as a result of code audits, pen tests and security reviews, the company added, and urged customers to plan an upgrade to this release.
Horizon3.ai researchers have shared commands customers can use to check whether their PaperCut server needs upgrading.
Since direct server IP access is required to exploit CVE-2023-39143, the risk of exploitation can also be mitigated by setting up an allowlist and populating it with device IP addresses that are permitted to communicate with the server. (That’s generally a good idea, even if you regularly update your PaperCut servers.)
“We are not releasing further details at this time to provide users adequate time to upgrade,” Horizon3.ai’s Naveen Sunkavally concluded.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/08/07/cve-2023-39143/