CVE-2024-1884

Executive Summary

CVE-2024-1884 is a Server-Side Request Forgery (SSRF) vulnerability in PaperCut NG/MF. This flaw allows an unauthenticated attacker to induce the server-side application to make HTTP requests to arbitrary domains of the attacker's choosing. The vulnerability resides in the server-side module, potentially enabling internal network reconnaissance, access to cloud metadata endpoints, or other internal services. The CVSS score is 6.5 (Medium), and no public exploit code or patch details are currently available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant due to the potential for internal network pivoting.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality Impact (C): Low (L)
• Integrity Impact (I): Low (L)
• Availability Impact (A): None (N)

The threat level is considered Medium due to the low complexity and no required privileges, but the impact is limited to low confidentiality and integrity. However, SSRF can be chained with other vulnerabilities to escalate impact.

Deep Dive & Mechanics

The vulnerability is a classic Server-Side Request Forgery (SSRF) in the PaperCut NG/MF server-side module. The application fails to properly validate or sanitize user-supplied URLs when making HTTP requests. An attacker can craft a malicious request that forces the PaperCut server to send HTTP requests to arbitrary domains, including internal IP addresses (e.g., 127.0.0.1, 10.0.0.1) or cloud metadata endpoints (e.g., 169.254.169.254).

Attack Flow:

1. The attacker identifies an endpoint in PaperCut that accepts a URL parameter (e.g., for fetching external resources, webhooks, or proxy functionality).
2. The attacker submits a request with a URL pointing to an internal service (e.g., http://127.0.0.1:8080/admin).
3. The PaperCut server processes the request and makes an HTTP request to the internal service.
4. The response from the internal service is returned to the attacker, potentially leaking sensitive data or allowing further exploitation.

Potential Impact:

• Internal network scanning and service discovery.
• Access to cloud metadata (e.g., AWS, GCP, Azure) to retrieve credentials.
• Bypassing firewalls and accessing internal-only services.
• Potential for remote code execution if combined with other vulnerabilities.

Vulnerable vs. Patched Code

No patch details are available. The vulnerable code likely involves a function that makes HTTP requests without proper validation of the target URL. A patched version would include:

• URL validation (allowlisting of allowed domains or IP ranges).
• Blocking of private IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16).
• Use of a dedicated HTTP client with restricted redirect following.

Example of vulnerable pseudo-code:

def fetch_url(url):
    response = requests.get(url)
    return response.text

Example of patched pseudo-code:

def fetch_url(url):
    parsed = urlparse(url)
    if not is_allowed_host(parsed.hostname):
        raise ValueError("Host not allowed")
    if is_private_ip(parsed.hostname):
        raise ValueError("Private IP not allowed")
    response = requests.get(url, allow_redirects=False)
    return response.text

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable PaperCut NG/MF instance (version unknown, but likely older than any patch).
2. Set up a listener on an internal network (e.g., a simple HTTP server on 127.0.0.1:8080).
3. Use the following curl command to test SSRF:

   curl -v "http://target.papercut.example.com:9191/app?url=http://127.0.0.1:8080/admin"
   

4. If successful, the response will contain the content from the internal server.

Exploitation:

• Use SSRF to access cloud metadata:

  curl -v "http://target.papercut.example.com:9191/app?url=http://169.254.169.254/latest/meta-data/"
  

• Perform internal port scanning by iterating through IPs and ports.

Blue Team

Detection:

• Monitor for outbound HTTP requests from the PaperCut server to unexpected IPs (especially private ranges).
• Look for requests to cloud metadata endpoints (169.254.169.254).
• Analyze logs for unusual URL parameters containing internal IPs.

Hunting:

• Search for log entries with URLs containing 127.0.0.1, 10., 172.16., 192.168., or 169.254..
• Use network flow data to identify connections from the PaperCut server to internal hosts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests from PaperCut server to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8).
  • Requests to cloud metadata IPs (169.254.169.254).
  • Unusual User-Agent strings in internal requests (e.g., "PaperCut-HTTP-Client").

• File IOCs:

  • Log entries containing URLs with internal IPs.
  • Temporary files created by the PaperCut server during SSRF requests.

• Behavioral IOCs:

  • Unusual increase in outbound HTTP traffic from the PaperCut server.
  • Access to internal services that are not normally accessed by PaperCut.

Detection Engineering

YARA Rule

rule CVE_2024_1884_SSRF_PaperCut {
    meta:
        description = "Detects SSRF attempts against PaperCut NG/MF"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1884"
    strings:
        $url_pattern = /(http|https):\/\/(127\.0\.0\.1|10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.|169\.254\.)/
        $metadata = "169.254.169.254"
        $internal_ip = /(127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-1884 SSRF Attempt Against PaperCut
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SSRF attempts targeting PaperCut NG/MF
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - '127.0.0.1'
            - '10.'
            - '172.16.'
            - '172.17.'
            - '172.18.'
            - '172.19.'
            - '172.20.'
            - '172.21.'
            - '172.22.'
            - '172.23.'
            - '172.24.'
            - '172.25.'
            - '172.26.'
            - '172.27.'
            - '172.28.'
            - '172.29.'
            - '172.30.'
            - '172.31.'
            - '192.168.'
            - '169.254.'
    condition: selection
falsepositives:
    - Legitimate internal network requests (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-1884 SSRF Attempt Against PaperCut"; flow:to_server; content:"GET"; http_method; content:"/app?url="; http_uri; pcre:"/(127\.0\.0\.1|10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.|169\.254\.)/Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the PaperCut server from internal networks if possible.
2. Implement network segmentation to restrict outbound traffic from the PaperCut server.
3. Apply a Web Application Firewall (WAF) rule to block requests containing private IPs or cloud metadata endpoints in URL parameters.

Long-term Fix:

• Monitor the vendor for a patch and apply it as soon as available.
• If no patch is forthcoming, consider disabling the vulnerable feature or implementing a reverse proxy that validates URLs.

Workaround:

• Modify the PaperCut configuration to disable URL fetching functionality if not required.
• Use a firewall to block outbound traffic from the PaperCut server to private IP ranges.

Valters IT