PaperCut is warning organizations to patch its NG and MF print management software after attackers began exploiting a vulnerability that can lead to remote code execution (RCE) without authentication.
PaperCut issued an urgent security advisory and is treating all versions of PaperCut NG and MF as potentially affected.
Emergency updates are available for versions 25 and 26, while fixes for version 24 are still in development.
What concerns me most is the combination of active exploitation and the level of access an attacker can potentially gain.
A vulnerable PaperCut server can provide attackers with an initial foothold into the network while potentially exposing sensitive documents and other data handled by the printing environment.
This “… ultimately lets an ill-intended actor execute any arbitrary attacked-controlled code,” said Huntress researchers John Hammond and Andrew Brandt in their analysis.
Jake Knott, head of threat intelligence at watchTowr, told eSecurityPlanet in an email that his team has been working with PaperCut since the disclosure to identify patch bypasses and help address them.
“The threat remains very real,” Knott said. “Follow PaperCut’s advisory for the latest patching guidance.”
How the PaperCut attack works
The vulnerability stems from how affected PaperCut servers handle authorization between pages and the components or actions associated with them.
In an unpatched system, an attacker can craft a request that references one page for rendering while executing an action belonging to another. The authorization check can trust the rendered page without properly enforcing the permissions required for the underlying component.
That opens the door to unauthorized configuration changes and access to sensitive functionality.
Huntress researchers reproduced the issue against PaperCut NG 25.0.11.75758 and demonstrated a complete pre-authentication RCE chain.
From a remote system, researchers were able to launch charmap[.]exe as SYSTEM under the PaperCut Application Server process, pc-app[.]exe.
Attackers are already probing compromised servers
Huntress reported exploitation in two customer environments as of Aug. 27. In one incident, the observed activity lasted less than two minutes.
Attackers executed Base64-encoded commands that decoded to whoami & ver, allowing them to identify the account running PaperCut and the Windows version. In a second incident, attackers added tasklist to enumerate running processes.
Researchers also recovered malicious Java files capable of executing commands on Windows or Linux. The files could enumerate stored files and write the results to disk.
One payload attempted to remove its output along with PaperCut’s server[.]log and Derby database log, potentially destroying evidence of the intrusion.
Those behaviors suggest defenders should not assume patching alone resolves the risk on previously exposed systems. If exploitation occurred before the update, an attacker may already have gained access.
Knott compared the situation with CVE-2023-27350, a previous PaperCut vulnerability exploited by ransomware groups and opportunistic attackers for initial access.
“We have seen this movie before,” Knott said, adding that attackers “have every reason to do it again.”
What organizations should do now
Organizations running versions 25 or 26 should apply PaperCut’s latest emergency update and continue monitoring its advisory as patching guidance evolves. For version 25 on Windows, PaperCut initially released NG build 25.0.12.76497 and MF build 25.0.12.76496.
Public access to the PaperCut Application Server should also be removed wherever possible. Restrict access to trusted IP addresses or a VPN. If a fixed version cannot be installed, isolate the affected server.
If a PaperCut server was exposed to the internet, investigate it for signs of compromise rather than relying on the patch alone. Preserve logs and other forensic evidence before restarting or upgrading the server.
Review activity originating from pc-app[.]exe and look for suspicious file creation or persistence mechanisms. Firewall and DNS logs can provide additional evidence, along with proxy and network flow data.
PaperCut also recommends checking for missing or unexpectedly truncated server[.]log files and errors containing Database error looking up cardID: VALUES CAST.
Knott emphasized the urgency: “This is not a vulnerability you want to wait on [for] change control or a ransom note to hit your desktop before applying a patch.”