CVE-2024-3037

Executive Summary

CVE-2024-3037 is an arbitrary file deletion vulnerability in PaperCut NG/MF affecting Windows servers with Web Print enabled. The flaw allows a low-privileged attacker with local login access to delete arbitrary files on the host server, potentially leading to denial of service or privilege escalation. The CVSS score is 7.8 (High), with low attack complexity and low privileges required. No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch. The vulnerability is mitigated by default Windows Server configurations that restrict local login to Administrators, but poses a risk in environments where non-administrative users can log in locally.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone software flaw in PaperCut NG/MF.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L) – Requires local login access to the Windows server.
• Attack Complexity: Low (AC:L) – No special conditions needed.
• Privileges Required: Low (PR:L) – Attacker needs low-privilege code execution.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Potential file read via deletion logs or side effects.
• Integrity Impact: High (I:H) – Arbitrary file deletion can corrupt system files.
• Availability Impact: High (A:H) – Deletion of critical files can cause denial of service.

Threat Level: High. Exploitation requires local access, but once achieved, the attacker can delete arbitrary files, potentially leading to full system compromise or service disruption.

Deep Dive & Mechanics

The vulnerability resides in the Web Print feature of PaperCut NG/MF on Windows. When Web Print is enabled, the application processes print jobs and temporary files. An attacker with local login access and low-privilege code execution can exploit improper file path validation to delete files outside the intended temporary directory. The flaw is triggered by crafting a malicious print job or file operation that references a path traversal sequence (e.g., ..\..\), allowing deletion of arbitrary files on the system.

Key Technical Details:

• Affected Component: Web Print service on Windows.
• Root Cause: Insufficient sanitization of file paths in temporary file handling.
• Attack Vector: Local – requires interactive login or remote code execution that spawns a local process.
• Prerequisites: Web Print enabled, non-administrative user granted local login rights.

The vulnerability was split into two CVEs (CVE-2024-3037 and CVE-2024-8404) to reflect different attack scenarios, but both share the same root cause.

Vulnerable vs. Patched Code

No official patch has been released. The vulnerable code likely involves a function that deletes temporary files without validating the path against a whitelist of allowed directories. A patched version would implement strict path validation, ensuring that deletion operations are confined to the application’s temporary folder.

Vulnerable Code (Conceptual):

// Vulnerable: No path validation
string tempPath = Path.Combine(webPrintTempDir, userInputFileName);
File.Delete(tempPath);

Patched Code (Conceptual):

// Patched: Validate path is within allowed directory
string tempPath = Path.Combine(webPrintTempDir, userInputFileName);
string fullPath = Path.GetFullPath(tempPath);
if (!fullPath.StartsWith(Path.GetFullPath(webPrintTempDir), StringComparison.OrdinalIgnoreCase))
{
    throw new SecurityException("Invalid file path.");
}
File.Delete(fullPath);

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Windows Server with PaperCut NG/MF installed and Web Print enabled.
• Non-administrative user account with local login rights.
• Ability to execute low-privilege code (e.g., via a scheduled task or script).

Exploitation Steps:

1. Log in locally to the Windows server as a standard user.
2. Identify the Web Print temporary directory (e.g., C:\ProgramData\PaperCut\WebPrint\Temp).
3. Craft a malicious print job or file operation that includes a path traversal sequence, such as:

   ..\..\Windows\System32\config\SAM
   

4. Trigger the file deletion via the Web Print service, causing the target file to be deleted.
5. Verify deletion by checking system behavior (e.g., inability to authenticate if SAM is deleted).

Example Payload (PowerShell):

# Simulate exploitation by sending a crafted request to Web Print
$targetFile = "..\..\Windows\System32\drivers\etc\hosts"
$webPrintUrl = "http://localhost:9191/webprint/delete?file=$targetFile"
Invoke-WebRequest -Uri $webPrintUrl -Method POST

Note: No public exploit code is available. The above is a conceptual example.

Blue Team (Detection & Defense)

Detection Steps:

1. Monitor for unusual file deletion events in Windows Security Event Log (Event ID 4663 – An attempt was made to access an object).
2. Look for file deletion operations targeting system-critical paths (e.g., C:\Windows\System32).
3. Enable auditing on the Web Print temporary directory to log all file deletions.
4. Use Sysmon to track process creation and file deletion events.

Defense Measures:

• Restrict local login rights to Administrators only (default Windows Server configuration).
• Disable Web Print if not required.
• Implement application whitelisting to prevent unauthorized code execution.
• Use Windows Defender Application Control (WDAC) to block untrusted scripts.

Indicators of Compromise (IOCs)

• File Paths: Deletion of files in C:\Windows\System32\, C:\ProgramData\PaperCut\, or other system directories.
• Event Logs: Event ID 4663 with Access Mask 0x6 (DELETE) on unexpected paths.
• Process: PaperCutWebPrint.exe or PaperCut.exe performing file deletions outside its temporary directory.
• Network: Unusual HTTP requests to the Web Print endpoint with path traversal sequences.

Detection Engineering

YARA Rule

rule CVE_2024_3037_File_Deletion {
    meta:
        description = "Detects attempts to exploit CVE-2024-3037 via path traversal in file deletion"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-3037"
    strings:
        $s1 = "..\\" nocase
        $s2 = "File.Delete" nocase
        $s3 = "WebPrint" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-3037 - Arbitrary File Deletion via PaperCut Web Print
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects file deletion events targeting system paths from PaperCut processes
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4663
        ObjectName|contains:
            - 'C:\Windows\System32'
            - 'C:\ProgramData\PaperCut'
        AccessMask: '0x6'
        ProcessName|contains: 'PaperCut'
    condition: selection
falsepositives:
    - Legitimate PaperCut maintenance operations
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-3037 - PaperCut Web Print Path Traversal"; flow:to_server,established; content:"/webprint/"; http_uri; content:".."; http_uri; distance:0; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict local login access to Administrators only on Windows servers hosting PaperCut.
2. Disable Web Print if not essential for business operations.
3. Monitor for suspicious file deletion events using the provided detection rules.

Long-Term Fix:

• Await an official patch from PaperCut. Apply it as soon as it becomes available.
• Implement strict file path validation in any custom scripts or integrations with PaperCut.

Workaround:

• Use Windows Group Policy to enforce that only Administrators can log in locally.
• Deploy endpoint detection and response (EDR) solutions to block unauthorized file deletions.

Valters IT