Full Report
Huntress is tracking a new PaperCut vulnerability, CVE-2023-39143, which allows full remote code execution on unpatched servers.
Analysis Summary
# Vulnerability: PaperCut MF/NG Path Traversal and Remote Code Execution
## CVE Details
- **CVE ID**: CVE-2023-39143
- **CVSS Score**: 8.4 (High) - *Note: Based on initial Horizon3 assessment; NVD scores may vary.*
- **CWE**: CWE-22 (Path Traversal) / CWE-434 (Unrestricted Upload of File with Dangerous Type)
## Affected Systems
- **Products**: PaperCut MF, PaperCut NG
- **Versions**: All versions prior to 22.1.3 (Specifically affecting Windows-based installations)
- **Configurations**: Systems where "External Hardware Integration" is enabled.
## Vulnerability Description
CVE-2023-39143 is a critical vulnerability involving a combination of path traversal and file upload flaws. In Windows environments, an unauthenticated attacker can exploit these weaknesses to perform arbitrary file reads and writes. This chain ultimately allows for Remote Code Execution (RCE) by uploading malicious files to the server’s web root or other sensitive directories.
## Exploitation
- **Status**: PoC available (Publicly disclosed by Horizon3.ai; Huntress has observed widespread exposure but initial reports focused on discovery and potential for exploitation).
- **Complexity**: Low
- **Attack Vector**: Network (Unauthenticated)
## Impact
- **Confidentiality**: High (Ability to read sensitive system files)
- **Integrity**: High (Ability to upload/overwrite files and execute code)
- **Availability**: High (Potential for full system takeover or service disruption)
## Remediation
### Patches
- **Upgrade to PaperCut MF/NG version 22.1.3 or later.**
- *Note*: Patches are primarily available for version 22 and onwards. Organizations on older major versions may need to upgrade their license to reach a supported, patched version.
### Workarounds
- **Restrict Access**: Ensure the PaperCut server is not publicly accessible from the internet. Limit access to trusted internal IP addresses.
- **Disable Integration**: Disable the "External Hardware Integration" setting.
- *Path*: Options -> Advanced -> External Hardware Integration
- *Action*: Uncheck “Enable external hardware integration.”
- *Warning*: This may break functionality for physical photocopiers/printers that rely on this integration.
## Detection
- **Indicators of Compromise**: Monitor for unusual file creation events in the PaperCut installation directories, specifically within web-accessible folders.
- **Detection Methods**:
- Scan for the specific path traversal patterns in web server logs targeting the `/custom-report-example/` or similar endpoints.
- Check the version of `pc-app.exe` or the PaperCut admin dashboard to ensure it is at or above 22.1.3.
## References
- **Vendor Advisory**: hxxps[://]www[.]papercut[.]com/kb/Main/securitybulletinjuly2023/
- **Huntress Blog**: hxxps[://]www[.]huntress[.]com/blog/another-papercut-cve-2023-39143-remote-code-execution
- **Technical Analysis (Horizon3)**: hxxps[://]www[.]horizon3[.]ai/cve-2023-39143-papercut-path-traversal-file-upload-rce-vulnerability/