CVE-2024-4712

Executive Summary

CVE-2024-4712 is a local privilege escalation vulnerability affecting PaperCut NG/MF on Windows servers with Web Print enabled. The flaw resides in the image-handler process, which can be tricked into creating arbitrary files on the filesystem when a maliciously crafted payload is provided. This allows an authenticated local attacker with low privileges to escalate to SYSTEM-level access. The vulnerability has been split into two CVEs (CVE-2024-4712 and CVE-2024-8405) and rescored with low Privileges Required and low Attack Complexity, reflecting the worst-case scenario where an Administrator has granted local login access to standard network users on the host server. No public exploit code or patch details are currently available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary software vulnerability in PaperCut NG/MF.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Local (L) – The attacker must have local access to the Windows server.
• Attack Complexity (AC): Low (L) – No special conditions are required to exploit the flaw.
• Privileges Required (PR): Low (L) – The attacker needs standard network user credentials.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): High (H) – Full system compromise leads to complete data disclosure.
• Integrity (I): High (H) – Full system compromise allows arbitrary file creation and modification.
• Availability (A): High (H) – Full system compromise can lead to denial of service.

Threat Level: High. The vulnerability allows local privilege escalation to SYSTEM, which is critical for environments where standard users have local login access to the PaperCut server.

Deep Dive & Mechanics

The vulnerability exists in the image-handler process of PaperCut NG/MF on Windows servers with Web Print enabled. The image-handler is responsible for processing image files submitted via the Web Print interface. When a maliciously formed payload is provided, the process incorrectly creates files that do not exist, bypassing normal file creation restrictions.

Root Cause: The image-handler process does not properly validate file paths or names before creating files. An attacker can craft a payload that includes path traversal sequences (e.g., ..\..\Windows\System32\evil.dll) or arbitrary file names, causing the process to create files in unintended locations.

Attack Flow:

1. The attacker authenticates to the PaperCut server with standard network user credentials.
2. The attacker submits a maliciously crafted Web Print job containing a payload that triggers the image-handler to create an arbitrary file (e.g., a DLL or executable) in a privileged location (e.g., C:\Windows\System32\).
3. The attacker then executes the created file (e.g., via a scheduled task or service restart) to escalate privileges to SYSTEM.

Why Windows Only: The vulnerability is specific to Windows due to the way the image-handler interacts with the Windows filesystem and the Web Print feature's implementation on that platform.

Vulnerable vs. Patched Code

No patch details are available. The vulnerable code is in the image-handler process, which likely uses a function similar to CreateFile or fopen without proper input validation.

Vulnerable Code (Conceptual):

// Vulnerable: No validation of file path
void process_image(char *payload) {
    char filepath[256];
    extract_filename(payload, filepath); // Extracts filename from payload
    FILE *f = fopen(filepath, "w"); // Creates file at arbitrary path
    // ... write data ...
}

Patched Code (Expected):

// Patched: Validate file path against allowed directory
void process_image(char *payload) {
    char filepath[256];
    extract_filename(payload, filepath);
    if (!is_path_allowed(filepath, "C:\\ProgramData\\PaperCut\\")) {
        return; // Reject if not in allowed directory
    }
    FILE *f = fopen(filepath, "w");
    // ... write data ...
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a Windows server running PaperCut NG/MF with Web Print enabled.
• Standard network user credentials (low privileges).
• Ability to submit Web Print jobs.

Exploitation Steps:

1. Identify Target: Scan for PaperCut servers with Web Print enabled (e.g., port 9191 or 9192).
2. Authenticate: Use valid credentials to log in to the Web Print interface.
3. Craft Payload: Create a malicious Web Print job that includes a payload designed to create a file in a privileged location. Example payload (conceptual):

   POST /web-print/submit HTTP/1.1
   Host: target:9191
   Content-Type: multipart/form-data
   
   --boundary
   Content-Disposition: form-data; name="file"; filename="..\..\Windows\System32\evil.dll"
   Content-Type: application/octet-stream
   
   [DLL binary data]
   --boundary--
   

4. Submit Job: Send the crafted request to the PaperCut server.
5. Trigger Execution: Execute the created file (e.g., via schtasks or rundll32) to escalate privileges.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual file creation events in C:\Windows\System32\ or other privileged directories.
• Alert on Web Print submissions with filenames containing path traversal sequences (..\).
• Monitor process creation events for image-handler.exe spawning unexpected child processes.

Defense:

• Restrict local login access to the PaperCut server to only necessary administrators.
• Disable Web Print if not required.
• Implement application whitelisting to prevent execution of untrusted binaries.
• Use Windows Defender or EDR to block file writes to protected directories.

Indicators of Compromise (IOCs)

• File Paths:
  • C:\Windows\System32\evil.dll
  • C:\Windows\System32\malicious.exe
  • Any file created in C:\Windows\System32\ or C:\Program Files\ by image-handler.exe
• Process Names:
  • image-handler.exe (legitimate but abused)
• Network Indicators:
  • Web Print submissions with filenames containing ..\ or ..\\
• Registry Keys:
  • HKLM\SYSTEM\CurrentControlSet\Services\EvilService (if attacker creates a service)
• Event IDs:
  • Windows Event ID 11 (FileCreate) for files created in protected directories.
  • Windows Event ID 4688 (Process Creation) for image-handler.exe spawning cmd.exe or powershell.exe.

Detection Engineering

YARA Rule

rule CVE_2024_4712_PaperCut_Arbitrary_File_Create {
    meta:
        description = "Detects attempts to exploit CVE-2024-4712 via malicious Web Print payloads"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-4712"
    strings:
        $path_traversal = /\.\.\\[^\\]+\\[^\\]+\.(dll|exe|bat|ps1)/ nocase
        $image_handler = "image-handler" nocase
        $web_print = "web-print" nocase
    condition:
        $image_handler and $web_print and $path_traversal
}

Sigma Rule

title: CVE-2024-4712 - PaperCut Arbitrary File Creation via Web Print
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects file creation events in privileged directories by image-handler.exe
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-4712
author: Valters IT
date: 2025-04-17
logsource:
    product: windows
    service: security
    category: file_event
detection:
    selection:
        Image|endswith: '\image-handler.exe'
        TargetFilename|contains:
            - 'C:\Windows\System32\'
            - 'C:\Program Files\'
            - 'C:\Windows\SysWOW64\'
    condition: selection
falsepositives:
    - Legitimate PaperCut updates or installations
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-4712 - PaperCut Web Print Path Traversal Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/web-print/"; http_uri; content:"filename=""; http_client_body; pcre:"/\.\.\\[^\\]+\\[^\\]+\.(dll|exe|bat|ps1)/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Web Print: If Web Print is not essential, disable it via the PaperCut admin console.
2. Restrict Local Access: Ensure only authorized administrators have local login access to the PaperCut server.
3. Monitor Logs: Enable auditing for file creation events in system directories.

Long-Term Fix:

• Apply the official patch from PaperCut when available (currently UNKNOWN/UNPATCHED).
• Implement input validation for file paths in the image-handler process.
• Use a sandbox or container for the image-handler process to limit file system access.

Workarounds:

• Use Windows Defender Application Control (WDAC) to block execution of binaries written by image-handler.exe.
• Deploy EDR solutions with behavioral detection for arbitrary file creation.

Valters IT