CVE-2023-3486
📋 TL;DR
An authentication bypass vulnerability in PaperCut NG allows unauthenticated remote attackers to upload arbitrary files to the server's storage. This can lead to denial of service by exhausting system resources. Affects PaperCut NG versions 22.0.12 and earlier.
💻 Affected Systems
- PaperCut NG
📦 What is this software?
Papercut Mf by Papercut
Papercut Ng by Papercut
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption through resource exhaustion, potentially enabling further attacks via file uploads if combined with other vulnerabilities.
Likely Case
Denial of service causing PaperCut NG to become unresponsive, disrupting print management services.
If Mitigated
Minimal impact with proper network segmentation and access controls limiting exposure.
🎯 Exploit Status
Simple HTTP requests can trigger the vulnerability. Public exploit code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 22.0.13 or later
Vendor Advisory: https://www.papercut.com/kb/Main/SecurityBulletinJuly2023/
Restart Required: Yes
Instructions:
1. Download PaperCut NG version 22.0.13 or later from PaperCut website. 2. Backup current installation. 3. Run installer to upgrade. 4. Restart PaperCut services.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to PaperCut NG administration interface to trusted IPs only
Configure firewall rules to limit access to PaperCut NG ports (typically 9191, 9192)
🧯 If You Can't Patch
- Implement strict network segmentation to isolate PaperCut NG from untrusted networks
- Monitor system resources and file upload activities for unusual patterns
🔍 How to Verify
Check if Vulnerable:
Check PaperCut NG version in administration interface under Help > About. If version is 22.0.12 or earlier, system is vulnerable.Check Version:
On Windows: sc query PaperCutNG | findstr DisplayName. On Linux: ps aux | grep papercutVerify Fix Applied:
Verify version is 22.0.13 or later in Help > About. Test file upload functionality with unauthenticated requests should be blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual file upload activities from unauthenticated sources
- Resource exhaustion alerts
- Failed authentication attempts followed by file uploads
Network Indicators:
- HTTP POST requests to file upload endpoints from unauthenticated sources
- Unusual traffic patterns to PaperCut NG ports
SIEM Query:
source="papercut-ng" AND (event="FILE_UPLOAD" AND user="anonymous") OR (resource_usage > 90%)