CVE-2023-39143 – CVE-2023-39143 is a path traversal vulnerabilit... (How to Fix)

Q: What is the severity of CVE-2023-39143?

CVE-2023-39143 has a CVSS score of 9.8 (CRITICAL). CVE-2023-39143 is a path traversal vulnerability in PaperCut NG/MF on Windows that allows attackers to upload, read, or delete arbitrary files. When external device integration is enabled (a common configuration), this can lead to remote code execution. Organizations running PaperCut NG/MF versions before 22.1.3 on Windows are affected.

📋 TL;DR

CVE-2023-39143 is a path traversal vulnerability in PaperCut NG/MF on Windows that allows attackers to upload, read, or delete arbitrary files. When external device integration is enabled (a common configuration), this can lead to remote code execution. Organizations running PaperCut NG/MF versions before 22.1.3 on Windows are affected.

💻 Affected Systems

Products:

PaperCut NG
PaperCut MF

Versions: All versions before 22.1.3

Operating Systems: Windows

Default Config Vulnerable: ⚠️ Yes

Notes: External device integration must be enabled for RCE, but this is a common configuration. Linux versions are not affected.

📦 What is this software?

Papercut Mf by Papercut

View all CVEs affecting Papercut Mf →

Papercut Ng by Papercut

View all CVEs affecting Papercut Ng →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full system compromise via remote code execution leading to data theft, ransomware deployment, or complete server takeover.

🟠

Likely Case

Unauthorized file access and manipulation, potentially escalating to RCE if external device integration is enabled.

🟢

If Mitigated

Limited impact if proper network segmentation and access controls prevent exploitation attempts.

🌐 Internet-Facing: HIGH - PaperCut servers are often exposed to the internet for printing services, making them prime targets.

🏢 Internal Only: HIGH - Even internally, attackers with network access can exploit this vulnerability.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation is straightforward with public proof-of-concept code available. Attackers can chain path traversal with file upload to achieve RCE.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 22.1.3 or later

Vendor Advisory: https://www.papercut.com/kb/Main/securitybulletinjuly2023/

Restart Required: Yes

Instructions:

1. Download PaperCut NG/MF version 22.1.3 or later from the PaperCut website. 2. Backup your current installation. 3. Run the installer to upgrade. 4. Restart the PaperCut application server.

🔧 Temporary Workarounds

Disable External Device Integration

windows

Temporarily disable external device integration to prevent RCE while patching.

Navigate to PaperCut admin interface > Options > Advanced > External Device Integration > Disable

Restrict Network Access

windows

Implement firewall rules to restrict access to PaperCut servers.

Use Windows Firewall or network firewall to allow only trusted IPs to access PaperCut ports (typically 9191, 9192)

🧯 If You Can't Patch

Implement strict network segmentation to isolate PaperCut servers from critical systems.
Deploy web application firewall (WAF) rules to block path traversal patterns and file upload attempts.

🔍 How to Verify

Check if Vulnerable:

Check PaperCut version in admin interface: Login > About. If version is below 22.1.3, you are vulnerable.

Check Version:

In PaperCut admin interface, navigate to Help > About PaperCut

Verify Fix Applied:

After patching, verify version shows 22.1.3 or higher in the About page. Test file upload functionality to ensure path traversal is blocked.

📡 Detection & Monitoring

Log Indicators:

Unusual file upload requests in PaperCut logs
Path traversal patterns like '../' in request logs
Unauthorized file access attempts

Network Indicators:

HTTP requests containing path traversal sequences to PaperCut endpoints
Unexpected file uploads to PaperCut server

SIEM Query:

source="papercut.log" AND ("..\" OR "../" OR "fileupload" OR "upload")

📊 Metadata

CVE ID: CVE-2023-39143

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-22

Published: August 4, 2023

Last Updated: May 5, 2025

🔗 References

https://www.horizon3.ai/cve-2023-39143-papercut-path-traversal-file-upload-rce-vulnerability/ Exploit,Third Party Advisory
https://www.papercut.com/kb/Main/securitybulletinjuly2023/ Vendor Advisory
https://www.horizon3.ai/cve-2023-39143-papercut-path-traversal-file-upload-rce-vulnerability/ Exploit,Third Party Advisory
https://www.papercut.com/kb/Main/securitybulletinjuly2023/ Vendor Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-39143, you might also want to check these: