CVE-2023-39143

What it actually does

PaperCut NG and PaperCut MF versions before 22.1.3 on Windows contain a path traversal flaw that allows an unauthenticated remote attacker to manipulate filesystem paths outside the intended application directory. Depending on the request path and accessible PaperCut functionality, the attacker can upload, read, or delete arbitrary files with the privileges of the PaperCut service account. When external device integration is enabled, which is common in PaperCut deployments, this arbitrary file write capability can be turned into remote code execution by placing attacker-controlled files in locations that PaperCut or Windows will execute or load.

Why it matters to the business

Successful exploitation can give an attacker control of the PaperCut server, exposing print-management data, credentials or secrets accessible to the service, and potentially providing a foothold into the broader Windows environment. Because PaperCut servers often integrate with directory services, printers, multifunction devices, and authentication infrastructure, compromise can disrupt printing operations, enable lateral movement, and support data theft or ransomware staging. The high CVSS score, high EPSS probability, and weaponized exploit maturity make this a high-priority issue even though it is not currently listed in CISA KEV.

How an attack unfolds

An attacker identifies an exposed PaperCut NG or MF server running a vulnerable version before 22.1.3 on Windows. They send specially crafted HTTP requests containing traversal sequences that cause PaperCut to resolve file operations outside the intended upload or application path. The attacker may first read files to understand the installation, service privileges, configuration, and integration settings. They can then upload or overwrite files in sensitive Windows or PaperCut-controlled locations. If external device integration is enabled, the attacker can use the arbitrary file write primitive to place executable content or scripts where they will be invoked by PaperCut or a related Windows process, resulting in remote code execution. After code execution, the attacker typically establishes persistence, collects credentials or configuration secrets, stages tools, and pivots to other systems reachable from the PaperCut server.

How to fix it

Upgrade PaperCut NG and PaperCut MF to version 22.1.3 or later on all Windows installations. If immediate upgrade is not possible, restrict network access to PaperCut administration and application interfaces to trusted management networks or VPNs, block direct Internet exposure, and limit access from untrusted subnets. Disable external device integration where it is not required until patched. Review the Windows service account used by PaperCut and reduce privileges to the minimum required. Monitor and restrict write permissions to sensitive directories, especially locations that can trigger code execution. Back up PaperCut configuration and validate application functionality after upgrade.

How to confirm the fix worked

Confirm the installed PaperCut NG or MF version is 22.1.3 or later through the PaperCut admin interface, application version files, or package inventory. Verify that PaperCut web interfaces are not reachable from untrusted networks unless explicitly required and protected. Test that requests containing traversal sequences such as ../, ..\, URL-encoded traversal, or double-encoded traversal are rejected and do not result in file access outside the intended directory. Validate that external device integration is disabled if not needed or that the system is patched before it is enabled. Review service permissions to confirm PaperCut does not run with excessive Windows privileges.

Typical attack path

1. Scan for exposed PaperCut NG or PaperCut MF web interfaces on Windows systems.
2. Fingerprint the PaperCut version and determine whether it is earlier than 22.1.3.
3. Send path traversal payloads in file-related requests to access paths outside the intended directory.
4. Read configuration, logs, or system files to determine permissions and integration settings.
5. Upload or overwrite attacker-controlled files in a location that can be executed or loaded by PaperCut or Windows.
6. Trigger execution, commonly through external device integration workflows when enabled.
7. Run post-exploitation commands under the PaperCut service context.
8. Establish persistence, collect credentials or configuration data, and attempt lateral movement.

How to detect it

Review PaperCut application logs, web server/access logs, reverse proxy logs, Windows Security logs, Sysmon/EDR telemetry, and file integrity monitoring data for signs of path traversal and follow-on execution. Look for HTTP requests to PaperCut endpoints containing traversal patterns such as ../, ..\, %2e%2e%2f, %2e%2e%5c, %252e%252e%252f, or attempts to access Windows paths such as C:\Windows\, C:\ProgramData\, or PaperCut installation directories. Investigate unexpected file creation, deletion, or modification by the PaperCut service account outside normal PaperCut directories. Review process telemetry for unusual child processes spawned by PaperCut services or Java, including cmd.exe, powershell.exe, wscript.exe, cscript.exe, certutil.exe, bitsadmin.exe, mshta.exe, rundll32.exe, or regsvr32.exe. Check for persistence artifacts such as new scheduled tasks, services, startup-folder files, or modified scripts. If external device integration is enabled, examine integration-related logs and directories for suspicious uploaded files or unexpected execution events. Correlate any suspicious file-write activity with inbound requests from the same source IP and subsequent outbound connections from the PaperCut server.

• ../
• ..\\
• %2e%2e%2f
• %2e%2e%5c
• %252e%252e%252f
• %252e%252e%255c
• /..%2f
• \\..\\
• C:\\Windows\\
• C:\\ProgramData\\
• C:\\Program Files\\PaperCut
• C:\\Program Files\\PaperCut MF
• C:\\Program Files\\PaperCut NG
• cmd.exe
• powershell.exe
• wscript.exe
• cscript.exe
• mshta.exe
• certutil.exe
• bitsadmin.exe
• rundll32.exe
• regsvr32.exe
• schtasks.exe
• PaperCut Application Server
• server-command.exe

What your security team should do

• Treat vulnerable Windows PaperCut NG/MF servers as high priority due to weaponized exploitation and high EPSS likelihood.
• Upgrade all PaperCut NG and MF installations to 22.1.3 or later as the primary fix.
• Immediately remove Internet exposure for PaperCut interfaces and restrict access to trusted administrative networks.
• Inventory PaperCut servers and confirm whether external device integration is enabled, prioritizing those systems first.
• Review PaperCut, web access, Windows event, EDR, and file integrity logs for historical signs of traversal attempts, unexpected file writes, or suspicious child processes.
• Hunt for newly created scripts, executables, web shells, or scheduled tasks on PaperCut servers around the time of any suspicious requests.
• Rotate credentials and secrets accessible to PaperCut if exploitation is suspected.
• Apply least-privilege hardening to the PaperCut Windows service account and monitor for unusual process execution from the PaperCut application directory.