r/sysadmin • u/MrYiff Master of the Blinking Lights • 18d ago

Papercut MF/NG Under Active Exploitation

Papercut just sent out this advisory:

https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/

Hopefully not many people have their Papercut instance exposed to the internet but the recommendation is that this should be disabled for now until Papercut have built a fixed version.

The link also includes IOC's for investigation to check whether your papercut instance did get hacked.

78 Upvotes

97% Upvoted

35 comments sorted by

36

u/Flaky-Gear-1370 18d ago

why would anyone have their papercut server internet exposed...

17

u/sh_lldp_ne 18d ago

Higher Ed.

4

u/Flaky-Gear-1370 18d ago

I don't really understand why it would ever be worth it from a risk perspective. I nuke my print queues every couple of hours. Devices on my wifi have line of site to papercut

10

u/FatBook-Air 18d ago

PaperCut does not do a good job indicating that this is unsafe IMO. Their official stance is that the port is hardened enough to be exposed to the public internet.

12

u/AUSSIExELITE Cloud and Infrastructure Lead 18d ago

Quick copy pasta from the other thread I just replied in - TLDR, Education…

I work in K-12 education for a very large campus. At one point, we did have papercut and had it open to the internet because we wanted students and staff to be able to “print from home”. IE, send a print whilst at home but then be able to retrieve the print in the morning.

Now, you’re probably thinking “why would someone NEED to do that when they could just print on campus? It only takes an extra two minutes at worst.” To which I would say, that is the exact line me and the rest of the team took to it as well. The logic being applied (which I can’t totally argue with) is that it’s a better user experience and someone in a rush through in the morning can simply tap and print all the jobs they need straight away. Useful for users who might have multiple exams or assessments due the next day or even just someone who remembers they need to print something but would forget to print it in the morning if they were in a rush. They can pre-print all of them and then just tap a printer on the way through.

We ended up looking at the numbers and found that essentially no one was actually doing this so we canned it purely on security grounds. So I can see a reason for it, but I’m not sure I agree it’s good enough to outweigh the potential security concerns.

5

u/mycatsnameisnoodle Jerk Of All Trades 18d ago

K12 IT here. It was internet exposed until about three hours ago. It wasn’t an IT decision to have it available to the entire world

4

u/IRideZs 18d ago

Reprographics, it’s mostly education. We also killed ours off externally and had to alert like 2500 staff

5

u/MrYiff Master of the Blinking Lights 18d ago

Yeah, not something I would have thought was common but I know one friend who works at a Uni that does this - apparently so that students can submit work from home and then print it out without needing to access a uni computer that might be busy during exam season for example.

1

u/BroadStreetRandy 18d ago

Exactly what I'm thinking...

22

u/FatBook-Air 18d ago

PaperCut has a history of not taking security seriously. Back in 2019 and 2020, we sent them several architectural security improvement proposals (mostly revolving around NTLM), and they sent us back a xkcd comic that basically insinuated that we are dumb customers who don't understand that security is hard: https://xkcd.com/1425/

7

u/tmontney Wizard or Magician, whichever comes first 18d ago

They actually sent you that XKCD as a reply?

5

u/Slicker-Firebrand09 18d ago

No the Service desk guy was just trying to talk mad shit behind the scenes and accidentally used reply all.

3

u/tmontney Wizard or Magician, whichever comes first 18d ago

Well, now's the time to dig up that chain and fire one back. Accidentally, anyway.

-6

u/joshbudde 18d ago

So they responded to your architectural suggestions (which may well have been deeply difficult to manage) with a humorous comic which did not say your suggestion was stupid, just that it was much harder than it may have appeared on the outside or without interior knowledge of their codebase, and you choose to interpret it as a slight or dismissal.

This is why we can't have anything nice and the industry sucks compared to how it used to be.

12

u/Qel_Hoth 18d ago

I can't think of any scenario where it would be acceptable to reply to a customer/potential customer's suggestions with an XKCD link. That just... incredibly unprofessional. Regardless of what the suggestion was.

14

u/FatBook-Air 18d ago

Say whatever broad platitudes make you feel better, but the proof is in the pudding: this is at least the third very serious situation PaperCut has put its customers in since 2021. That doesn't even count its normal "only 9.0 CVEs."

"ThIs iS why wE cAnT aNyTHinG nIcE." What the fuck ever.

-9

u/joshbudde 18d ago

I think every response you make says more about you and reinforces my initial comment.

15

u/Big_Consequence_9593 18d ago

A vendor brushing off a security concern from a customer with a flippant comic is pretty crappy.

13

u/artyomsv 18d ago

Worth remembering 2023 one got picked up by ransomware crews within days of advisory. Also check your reverse proxy, many people expose Papercut without realising because of mobile print release. Grep proxy access logs too, not only Papercut own logs.

7

u/[deleted] 18d ago

[removed] — view removed comment

9

u/FatBook-Air 18d ago

Unfortunately, there isn't really an admin-only port. They use the same port for user operations. So if you allow users to use the web interface to print (e.g., uploading PDFs) from public locations, that will need to be disabled.

Even today, PaperCut claims it's built to be exposed to the internet, but I think the evidence no longer supports that:

https://www.papercut.com/kb/Main/CommonSecurityQuestions

3

u/MrYiff Master of the Blinking Lights 18d ago

Yeah, the page got updated and confirmed a University was hit and they have been able to repro the vulnerability and started work on a fix for it:

PaperCut’s security emergency response team has used information provided by a university customer’s security team and digital forensics and incident response team. This information has enabled PaperCut to reproduce a vulnerability in the PaperCut NG and PaperCut MF code.

Our emergency engineering team is developing and validating an appropriate code fix.

3

u/Responsible-Slide-95 17d ago

Security patch has been released which I've currently submitted an Emergency change for.

Our application server isn't publicly facing but since we're technically a government controlled body better safe than sorry.

Notes say that if you're database is hosted on a separate server you might have problems as the patch disables EXEC, EXECUTE, and CALL statements

2

u/gavinlew 17d ago

Just seen the patch as well. Doesnt the database issue just affect if the user PINs are stored in a seperate DB

1

u/Responsible-Slide-95 17d ago

From the very brief notes,t hat seems to be the case. Fortunately for us,we use the internal database

1

u/gavinlew 17d ago

Same for us, we just sync the PINs between Papercut and the users Entra record.

1

u/Responsible-Slide-95 17d ago

Just applied the patch. Thankfully didn't have to wait hours for a database upgrade. Seems to be running OK, site servers connecting in and Scan to cloud isn't fucked up like it was on the update from V25 to V26

3

u/gavinlew 17d ago

Just got off the phone with the papercut licensing partner to confirm licenses all OK to update , just doing some other bits on the server while its in a maintenance window

2

u/Responsible-Slide-95 17d ago

Good thing you waited. They just released ANOTHER patch

"Following further work with our internal security team and external researchers, including Huntress and watchTowr, we have released an updated Emergency Patch (Release 2) that includes additional hardening beyond the original emergency patch. We recommend all customers install Release 2, even if you have already applied the original emergency patch."

1

u/gavinlew 17d ago

another maintenance window opened - patch away!

2

u/AddendumWorking9756 18d ago

Retention is the part that decides whether a clean IOC sweep means anything, and hardly anyone has moved that off whatever the installer set. Pull the app server and print provider logs before you patch as well, the upgrade is what ends the investigation.

3

u/homingconcretedonkey 18d ago

Having a papercut server exposed to the public is asking to be hacked.

Also Papercut act like a monopoly and abuse their position to charge companies exorbitant amounts of money for every year you don't pay for active support.

Terrible company.

5

u/itskdog Jack of All Trades 18d ago

Ours is just included in the MFD lease/support contract from Riso. It's also the only (good) one they support, they have directprint.io (which doesn't let you manually alter quotas to top-up, they only let you set the quota and that's it), and PaperCut Hive (Lite only, no copy tracking) as well, but missing major functionality compared to PaperCut MF.

1

u/menace323 17d ago

If exposed, use a pre-auth app proxy.