CVE-2023-39470

Executive Summary

CVE-2023-39470 is a critical remote code execution (RCE) vulnerability in PaperCut NG, specifically within the print.script.sandboxed setting. The flaw exposes a dangerous function that allows authenticated attackers to execute arbitrary code with SYSTEM privileges. With a CVSS score of 7.2, this vulnerability poses a severe threat to affected systems, enabling full compromise of the host. The vulnerability is tracked as ZDI-CAN-20965 and has no known public exploit or patch details at this time.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)
• Threat Level: Critical – Exploitation leads to full SYSTEM-level compromise.

Deep Dive & Mechanics

The vulnerability resides in the print.script.sandboxed setting within PaperCut NG. This setting is intended to sandbox print scripts, but due to improper management, a dangerous function is exposed. An authenticated attacker can craft a malicious print script that bypasses the sandbox restrictions, leveraging the exposed function to execute arbitrary code in the context of the SYSTEM account. The attack requires authentication but no user interaction, making it a high-severity threat for environments where attackers have low-privileged access.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Exposes dangerous function without proper sandboxing
function executePrintScript(script) {
    let sandbox = new Sandbox();
    sandbox.exposeFunction('dangerousFunction', dangerousFunction);
    sandbox.run(script);
}

Patched Code (Conceptual):

// Patched: Removes exposure of dangerous function
function executePrintScript(script) {
    let sandbox = new Sandbox();
    // No dangerous functions exposed
    sandbox.run(script);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Authenticated access to PaperCut NG web interface.
• Ability to upload or modify print scripts.

Exploitation Steps:

1. Log in to PaperCut NG with valid credentials.
2. Navigate to the print script configuration.
3. Upload a malicious script that calls the exposed dangerous function.
4. Trigger the script execution to achieve SYSTEM-level RCE.

Example Payload (Conceptual):

// Malicious print script
dangerousFunction('cmd.exe /c calc.exe');

Blue Team

Detection:

• Monitor for unusual print script uploads or modifications.
• Alert on execution of scripts containing calls to dangerousFunction or similar patterns.
• Review authentication logs for suspicious activity.

Hunting:

• Search for scripts with elevated privileges or unusual function calls.
• Analyze process creation events for unexpected SYSTEM-level processes.

Indicators of Compromise (IOCs)

• Network: Unusual outbound connections from PaperCut NG server.
• File: Modified or new print script files in the PaperCut NG directory.
• Process: SYSTEM-level processes spawned by PaperCut NG (e.g., cmd.exe, powershell.exe).
• Log: Authentication logs showing repeated script uploads.

Detection Engineering

YARA Rule

rule CVE_2023_39470_PaperCut_RCE {
    meta:
        description = "Detects malicious print scripts exploiting CVE-2023-39470"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-39470"
    strings:
        $dangerous_func = "dangerousFunction" nocase
        $script_ext = ".js" nocase
    condition:
        $dangerous_func and $script_ext
}

Sigma Rule

title: PaperCut NG RCE via print.script.sandboxed
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation of CVE-2023-39470 in PaperCut NG
author: Valters IT
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: 'PaperCut.exe'
        Image|endswith:
            - 'cmd.exe'
            - 'powershell.exe'
            - 'wscript.exe'
    condition: selection
falsepositives:
    - Legitimate administrative scripts
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-39470 PaperCut NG RCE Attempt"; flow:to_server,established; content:"dangerousFunction"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch: Apply vendor patches as soon as available. Monitor PaperCut NG security advisories.
2. Workaround: Disable the print.script.sandboxed feature if not required.
3. Access Control: Restrict authentication to trusted users only.
4. Monitoring: Enable detailed logging for print script execution and review regularly.
5. Network Segmentation: Isolate PaperCut NG servers from critical systems.

Valters IT