PaperCut NG/MF up to 23.0.8 on Windows Web Print link following

Summaryinfo

A vulnerability classified as critical was found in PaperCut NG and MF up to 23.0.8 on Windows. The impacted element is an unknown function of the component Web Print. Such manipulation leads to link following. This vulnerability is documented as CVE-2024-8404. The attack needs to be performed locally. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, has been found in PaperCut NG and MF up to 23.0.8 on Windows. Affected by this issue is an unknown function of the component Web Print. The manipulation with an unknown input leads to a link following vulnerability. Using CWE to declare the problem leads to CWE-59. The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. Impacted is confidentiality, integrity, and availability. CVE summarizes:

An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability, an attacker must first obtain local login access to the Windows Server hosting PaperCut NG/MF and be capable of executing low-privilege code directly on the server via the web-print-hot-folder. Important: In most installations, this risk is mitigated by the default Windows Server configuration, which restricts local login access to Administrators only. However, this vulnerability could pose a risk to customers who allow non-administrative users to log into the local console of the Windows environment hosting the PaperCut NG/MF application server. Note: This CVE has been split from CVE-2024-3037.

The weakness was released by Amol Dosanjh. The advisory is shared for download at papercut.com. This vulnerability is handled as CVE-2024-8404 since 09/04/2024. The exploitation is known to be easy. The attack needs to be approached locally. The exploitation needs additional levels of successful authentication. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 209141 (PaperCut MF < 23.0.9 Multiple Vulnerabilities), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 23.0.9 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (209141). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• PaperCut

Name

• MF
• NG

Version

• 23.0.0
• 23.0.1
• 23.0.2
• 23.0.3
• 23.0.4
• 23.0.5
• 23.0.6
• 23.0.7
• 23.0.8

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion