CVE-2024-8405
📋 TL;DR
This vulnerability allows attackers to create arbitrary files on Windows PaperCut NG/MF servers with Web Print enabled, potentially flooding disk space and causing Denial of Service. Only affects Windows servers with the Web Print feature enabled. Attackers can exploit this without authentication.
💻 Affected Systems
- PaperCut NG
- PaperCut MF
📦 What is this software?
Papercut Mf by Papercut
Papercut Ng by Papercut
⚠️ Risk & Real-World Impact
Worst Case
Complete disk space exhaustion leading to system crash, service disruption, and potential data loss if critical system files are overwritten.
Likely Case
Disk space consumption causing performance degradation, service interruptions, and potential system instability.
If Mitigated
Minimal impact with proper disk monitoring, quotas, and timely patching.
🎯 Exploit Status
Exploitation requires Web Print to be enabled and appears straightforward based on vulnerability description
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions with May 2024 security updates
Vendor Advisory: https://www.papercut.com/kb/Main/Security-Bulletin-May-2024/
Restart Required: Yes
Instructions:
1. Download latest PaperCut NG/MF version from vendor portal. 2. Backup current installation. 3. Run installer with administrative privileges. 4. Restart PaperCut services. 5. Verify update in Admin interface.
🔧 Temporary Workarounds
Disable Web Print Feature
windowsTemporarily disable the Web Print feature to prevent exploitation
Navigate to PaperCut Admin interface > Options > Web Print > Disable
Implement Disk Quotas
windowsSet disk usage limits on PaperCut directories to limit damage
fsutil quota modify C:\PaperCut\path Limit 1000000000
🧯 If You Can't Patch
- Disable Web Print feature immediately
- Implement strict network access controls to limit exposure to PaperCut web interface
🔍 How to Verify
Check if Vulnerable:
Check PaperCut version in Admin interface and verify Web Print is enabled on Windows serverCheck Version:
Check version in PaperCut Admin interface under 'About' sectionVerify Fix Applied:
Verify PaperCut version is updated to May 2024 security release in Admin interface📡 Detection & Monitoring
Log Indicators:
- Unusual file creation patterns in PaperCut logs
- Rapid disk space consumption alerts
- Multiple failed or suspicious web print requests
Network Indicators:
- High volume of requests to /web-print endpoint
- Unusual payloads in POST requests to PaperCut
SIEM Query:
source="papercut" AND (event="file_creation" OR event="disk_full")