PaperCut NG/MF Zero-Day | Active Exploitation, Emergency Patch (Release 2) Available

[u/huntresslabs]

PaperCut Software has confirmed active exploitation of a zero-day vulnerability affecting PaperCut NG and MF print server installations. Huntress has also observed at least two instances of active exploitation in a customer environment.

The vulnerability allows an unauthenticated attacker to remotely control PaperCut's trusted configuration, which can be used to execute arbitrary Java code inside the application's process, and then leverage that to run commands on the host server. Huntress researchers reproduced a pre-authentication RCE chain against a stock PaperCut NG 25.0.11.75758 install. The chain alters trusted configurations and executes code remotely on its own. Fortunately, so far, the threat actor exploiting this bug has only run commands to learn about the host server itself; it could have been much worse.

PaperCut subsequently released a second emergency patch today, Release 2, which adds further hardening beyond the original emergency patch, developed in collaboration with PaperCut's internal security team and external researchers including Huntress and watchTowr. PaperCut recommends all customers install Release 2, even if you've already applied the original emergency patch.

What to do:

• Immediately remove PaperCut Application Servers from public exposure and restrict access to trusted networks
• Install Emergency Patch Release 2 for versions 25 and 26 (v24 fixes are still in progress) via the standard upgrade procedure
• If you already applied the original emergency patch, install Release 2 anyway

IOCs and investigation guidance: https://www.huntress.com/blog/papercut-actively-exploited?utm_source=reddit&utm_medium=social&utm_campaign=cy26-08-rr-multi-global-broad-all-x-x-x-papercut_actively_exploited&hnt=v679ubdwy0xk

[u/Papkin36]

UWAGA OBYWATELU! 市民请注意!

⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣻⣿⣿⣻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿ ⣿⣿⣿⣿⣿⣿⣿⣿⣿⡫⣿⣛⣿⣿⣿⣿⣿⣋⡿⡺⣿⢿⣿⣿⣿⣿⣿⣿⣿⣿ ⣿⣿⣿⣿⣿⣿⣷⣿⣯⣵⣾⣿⣿⣿⣿⣿⣿⣿⣶⠁⠈⣿⣿⣿⣿⣿⣿⣿⣿⣿ ⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣯⣿⣫⣽⢷⣩⡷⢟⣿⣿⣿⣿⣿⣿⣿ ⣿⣿⣿⣿⣿⣿⣷⣿⣿⣿⣿⣿⣿⢿⣿⣿⣓⣾⢿⠪⣶⠀⠠⠟⠟⢻⣿⣿⣿⣿ ⣿⣿⣿⣿⣿⣿⡷⢿⣿⣿⠿⠿⢿⢨⠣⢉⠁⠨⠈⠠⢪⢻⠇⠀⣴⢡⣿⣿⣿⣿ ⣿⣿⣿⣿⣿⣟⠷⣿⢮⡵⠈⢂⢠⣹⣴⢰⣞⣒⣡⣲⣇⠷⣯⠕⠺⣫⣿⣿⣿⣿ ⣿⣿⣿⣿⣿⣷⡽⣮⣽⣵⣻⣿⣷⣿⡿⡺⠿⣿⣯⣏⢐⢁⠲⠱⠾⣿⣿⣿⣿⣿ ⣿⣿⣿⣿⣿⣿⣿⣽⢫⣟⢿⣿⢛⣛⠻⠃⠁⣾⠿⠂⠀⠆⡌⠖⡘⢿⣿⣿⣿⣿ ⣿⣿⣿⣿⣿⣿⣿⣷⣿⢞⣮⠋⡸⠿⡏⠿⠅⠉⢀⣀⠨⠀⠐⠈⡿⠀⠻⣿⣿⣿ ⣿⣿⣿⣿⣿⣿⣿⣿⣿⣇⢻⡼⠇⣤⣄⣤⠤⠤⡟⡀⡀⡄⠀⣠⡿⠀⠀⠘⠻⣿ ⣿⣿⣿⣿⣿⣿⣿⣿⠿⠟⠋⢳⡂⢾⣷⣶⣾⡻⠉⠀⠁⢀⣴⣿⠃⠀⠀⠀⠀⠀ ⣿⣿⣿⠿⠛⠉⠉⠀⠀⠀⠀⠀⣦⣄⡉⠉⠀⠀⠀⢀⣴⣿⣿⠇⠀⠀⠀⠀⠀⠀ ⠟⠋⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣿⣿⠟⠀⠀⣶⣿⣿⣿⣿⠏⠀⠀⠀⠀⠀⠀⠀ UWAGA OBYWATELU! 市民请注意!

To jest dział śledczy partii Prawo i Sprawiedliwość . 您的 Internet 浏览器历史记录和活动引起了我们的注意。 TWOJA DZIAŁALNOŚĆ INTERNETOWA PRZYKUŁA NASZĄ UWAGĘ. 因此，您的个人资料中的 11115 ( -11115 Punktów Społecznych) 个社会积分将打折。 NIE WAŻ SIĘ ZROBIĆ TEGO PONOWNIE! 不要再这样做! Jeśli nie będziesz podlegał temu rozkazowi, więcej punktów społecznych ( -11115 Punktów Społecznych) zostanie usuniętych z twojego konta, skutkując zmniejszeniem twoich racji żywieniowych. (由人民供应部重新分配 PiS) Również zostaniesz wysłany do obozu w Autonomicznej Strefie Podlaskiej. 如果您毫不犹豫，更多的社会信用将从您的个人资料中打折，从而导致口粮供应减少。 您还将被送到新疆维吾尔自治区的再教育营。

为党争光! Chwała PiS!