{ "file_item": { "filepath": "security-advisories", "filename": "CERT-EU-SA2023-025.pdf" }, "title": "Critical vulnerabilities in PaperCut", "serial_number": "2023-025", "publish_date": "20-04-2023 13:15:00", "description": "A new security advisory has been issued concerning two critical vulnerabilities in PaperCut MF/NG, which are actively being exploited in the wild. The vulnerabilities allow unauthenticated remote code execution and information disclosure. PaperCut users are strongly urged to update their software immediately to mitigate these risks.", "url_title": "2023-025", "content_markdown": "--- \ntitle: 'Critical vulnerabilities in PaperCut' \nversion: '1.0'\nnumber: '2023-025'\noriginal_date: 'April 18, 2023'\ndate: 'April 20, 2023'\n---\n\n_History:_\n\n* _20/04/2023 --- v1.0 -- Initial publication_\n\n# Summary\n\nA new security advisory has been issued concerning two critical vulnerabilities in PaperCut MF/NG, which are actively being exploited in the wild. The vulnerabilities allow unauthenticated remote code execution and information disclosure. PaperCut users are strongly urged to update their software immediately to mitigate these risks. [1]\n\n# Technical Details\n\nThe first vulnerability, identified as `CVE-2023\u201327350` and `ZDI-CAN-18987 / PO-1216`, is an unauthenticated remote code execution flaw. This vulnerability affects both application and site servers. An attacker can exploit this flaw to execute arbitrary code on the affected server without any need for authentication, potentially leading to a complete compromise of the system. This vulnerability scores 9.8 on CVSS v3.1, classifying it as critical.\n\nThe second vulnerability, identified as `CVE-2023\u201327351` and `ZDI-CAN-19226 / PO-1219`, is an unauthenticated information disclosure flaw specifically for application servers. This vulnerability allows an attacker to access sensitive user information without authentication, potentially exposing data such as usernames, full names, email addresses, office/department information, and card numbers. Additionally, the attacker may retrieve hashed passwords for internally created PaperCut users. However, password hashes for users synced from directory sources like Microsoft 365, Google Workspace, and Active Directory remain unaffected. Although this vulnerability has not been observed being exploited, it is still essential to address it. The severity of this vulnerability is high, with a CVSS v3.1 score of 8.2.\n\n# Affected Products\n\n**CVE-2023\u201327350**:\n\nPaperCut MF or NG version 8.0 or later, on all OS platforms.\n\n**CVE-2023\u201327351**:\n\nPaperCut MF or NG version 15.0 or later, on all OS platforms.\n\n# Recommandations\n\nUpgrade to PaperCut MF and PaperCut NG versions 20.1.7, 21.2.11, or 22.0.9 and later to address these vulnerabilities.\n\n## Detections\n\nTo check for exploitation, PaperCut recommends the following: [1]\n\n- Look for suspicious activity in `Logs` > `Application Log`, within the PaperCut admin interface.\n- Keep an eye out in particular for any updates from a user called `[setup wizard]`.\n- Look for new (suspicious) users being created, or other configuration keys being tampered with.\n- If the Application Server logs happen to be in debug mode, check to see if there are lines mentioning `SetupCompleted` at a time not correlating with the server installation or upgrade. Server logs can be found e.g., in `[app-path]/server/logs/*.*` where `server.log` is normally the most recent log file.\n\n# References\n\n[1] ", "content_html": "

History:

Summary

A new security advisory has been issued concerning two critical vulnerabilities in PaperCut MF/NG, which are actively being exploited in the wild. The vulnerabilities allow unauthenticated remote code execution and information disclosure. PaperCut users are strongly urged to update their software immediately to mitigate these risks. [1]

Technical Details

The first vulnerability, identified as CVE-2023\u201327350 and ZDI-CAN-18987 / PO-1216, is an unauthenticated remote code execution flaw. This vulnerability affects both application and site servers. An attacker can exploit this flaw to execute arbitrary code on the affected server without any need for authentication, potentially leading to a complete compromise of the system. This vulnerability scores 9.8 on CVSS v3.1, classifying it as critical.

The second vulnerability, identified as CVE-2023\u201327351 and ZDI-CAN-19226 / PO-1219, is an unauthenticated information disclosure flaw specifically for application servers. This vulnerability allows an attacker to access sensitive user information without authentication, potentially exposing data such as usernames, full names, email addresses, office/department information, and card numbers. Additionally, the attacker may retrieve hashed passwords for internally created PaperCut users. However, password hashes for users synced from directory sources like Microsoft 365, Google Workspace, and Active Directory remain unaffected. Although this vulnerability has not been observed being exploited, it is still essential to address it. The severity of this vulnerability is high, with a CVSS v3.1 score of 8.2.

Affected Products

CVE-2023\u201327350:

PaperCut MF or NG version 8.0 or later, on all OS platforms.

CVE-2023\u201327351:

PaperCut MF or NG version 15.0 or later, on all OS platforms.

Recommandations

Upgrade to PaperCut MF and PaperCut NG versions 20.1.7, 21.2.11, or 22.0.9 and later to address these vulnerabilities.

Detections

To check for exploitation, PaperCut recommends the following: [1]

References

[1] https://www.papercut.com/kb/Main/PO-1216-and-PO-1219

", "licence": { "title": "Creative Commons Attribution 4.0 International (CC-BY 4.0)", "link": "https://creativecommons.org/licenses/by/4.0/", "restrictions": "https://cert.europa.eu/legal-notice", "author": "The Cybersecurity Service for the Union institutions, bodies, offices and agencies" } }