Headline
CVE-2023-2533: PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF | Advisories | Fluid Attacks
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code. This could be exploited if the target is an admin with a current login session. Exploiting this would typically involve the possibility of deceiving an admin into clicking a specially crafted malicious link, potentially leading to unauthorized changes.
Summary
Name
PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF
Code name
Arcangel
Product
PaperCut MF/NG
Affected versions
Version 22.0.10 (Build 65996 2023-03-27)
State
Public
Release date
2023-04-10
Vulnerability
Kind
Cross-site request forgery
Rule
007. Cross-site request forgery
Remote
Yes
CVSSv3 Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
CVSSv3 Base Score
8.4
Exploit available
Yes
CVE ID(s)
CVE-2023-2533
Description
PaperCut MF/NG version 22.0.10 allows to persuade an administrator to alter server configurations. This is possible because the application is vulnerable to CSRF.
Vulnerability
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code. This could be exploited if the target is an admin with a current login session. Exploiting this would typically involve the possibility of deceiving an admin into clicking a specially crafted malicious link, potentially leading to unauthorized changes.
Exploitation
Will be available soon.
Evidence of exploitation
It is important to clarify that we only need an administrator to perform the necessary configurations with the CSRF that will later enable the RCE. This RCE is triggered when anyone on the network sends a print job to an infected printer.
Unlike administrators, a user without administrative privileges, within the network where the printers are configured, will need the Mobility Print extension to be able to see the printers configured by the administrator of the PaperCut instance, and thus be able to send the print job to the infected printer.
Our security policy
We have reserved the ID CVE-2023-2533 to refer to this issue from now on.
- https://fluidattacks.com/advisories/policy/
System Information
Version: PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27)
Operating System: MacOS
Mitigation
An updated version of PaperCut is available at the vendor page.
Credits
The vulnerability was discovered by Carlos Bello from Fluid Attacks’ Offensive Team.
References
Vendor page https://www.papercut.com/
PaperCut NG/MF Security Bulletin (June 2023) | CVEs addressed https://www.papercut.com/kb/Main/SecurityBulletinJune2023#cves-addressed
Timeline
2023-05-04
Vulnerability discovered.
2023-05-04
Vendor contacted.
2023-05-04
Vendor replied acknowledging the report.
2023-05-08
Vendor Confirmed the vulnerability.
2023-06-09
Vulnerability patched.
2023-06-13
Public Disclosure.
Related news
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code. This could be exploited if the target is an admin with a current login session. Exploiting this would typically involve the possibility of deceiving an admin into clicking a specially crafted malicious link, potentially leading to unauthorized changes.