CVE-2024-8404

Executive Summary

CVE-2024-8404 is an arbitrary file deletion vulnerability in PaperCut NG/MF affecting Windows servers with Web Print enabled. The vulnerability requires local login access to the Windows server and the ability to execute low-privilege code via the web-print-hot-folder. While default Windows Server configurations restrict local login to Administrators, environments allowing non-administrative users to log into the local console are at risk. The vulnerability has a CVSS score of 7.8 (High) and is currently unpatched per the latest update (May 2025). No public exploit code or proof-of-concept is available at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a server-side application vulnerability in PaperCut NG/MF, a commercial print management solution.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L) – requires physical or remote desktop access to the server.
• Attack Complexity: Low (AC:L) – no special conditions beyond local access.
• Privileges Required: Low (PR:L) – attacker needs low-privilege code execution.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – vulnerability does not cross trust boundaries.
• Confidentiality Impact: High (C:H) – potential to delete sensitive files.
• Integrity Impact: High (I:H) – arbitrary file deletion.
• Availability Impact: High (A:H) – deletion of critical system files can cause denial of service.

Threat Level: High. Exploitation requires local access, but once achieved, an attacker can delete arbitrary files, potentially causing system instability or data loss.

Deep Dive & Mechanics

The vulnerability resides in the Web Print feature of PaperCut NG/MF on Windows. The web-print-hot-folder is a directory where print jobs are temporarily stored. Due to insufficient input validation, an attacker with low-privilege code execution on the server can craft a malicious file path that traverses outside the intended hot-folder directory, allowing deletion of arbitrary files on the system.

Root Cause: The application does not properly sanitize file paths when processing print jobs in the web-print-hot-folder. This allows path traversal (e.g., using ../ sequences) to delete files outside the designated folder.

Attack Flow:

1. Attacker gains local login access to the Windows server (e.g., via compromised credentials or physical access).
2. Attacker executes low-privilege code that interacts with the web-print-hot-folder.
3. The code sends a crafted print job with a malicious file path (e.g., ../../Windows/System32/config/SAM).
4. PaperCut processes the job and deletes the targeted file.

Impact: Deletion of critical system files (e.g., SAM, SYSTEM, boot configuration) can lead to system crash, data loss, or privilege escalation.

Vulnerable vs. Patched Code

No specific code snippets are available. The vulnerability is in the file path handling logic within the web-print-hot-folder processing module. The patched version (expected in May 2025) should include proper path canonicalization and validation to prevent traversal.

Vulnerable Code (Conceptual):

// Vulnerable: Directly uses user-supplied path
string filePath = Path.Combine(hotFolderPath, userInput);
File.Delete(filePath);

Patched Code (Conceptual):

// Patched: Validate and canonicalize path
string fullPath = Path.GetFullPath(Path.Combine(hotFolderPath, userInput));
if (!fullPath.StartsWith(hotFolderPath, StringComparison.OrdinalIgnoreCase))
{
    throw new SecurityException("Invalid file path.");
}
File.Delete(fullPath);

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local login access to a Windows Server running PaperCut NG/MF with Web Print enabled.
• Ability to execute low-privilege code (e.g., via a scheduled task, PowerShell, or a compiled executable).

Exploitation Steps:

1. Gain Access: Use compromised credentials or physical access to log into the server.
2. Craft Payload: Create a script (e.g., PowerShell) that sends a malicious print job to the web-print-hot-folder.
3. Execute: Run the script to trigger file deletion.

Example PowerShell Payload (Conceptual):

# Simulate a print job with path traversal
$hotFolder = "C:\ProgramData\PaperCut\web-print-hot-folder"
$maliciousPath = "../../Windows/System32/config/SAM"
$jobFile = Join-Path $hotFolder "job_$(Get-Random).txt"
Set-Content -Path $jobFile -Value "file=$maliciousPath"
# Trigger processing (may require additional steps)

Note: No public exploit code exists. This is a conceptual demonstration.

Blue Team (Detection & Defense)

Detection:

• Monitor file deletion events in the web-print-hot-folder (Event ID 4663 for Windows).
• Look for unusual file paths (e.g., containing ..) in print job submissions.
• Alert on low-privilege processes attempting to delete files outside the hot-folder.

Defense:

• Restrict local login access to Administrators only (default Windows Server configuration).
• Implement application whitelisting to prevent unauthorized code execution.
• Use Windows Defender Application Control (WDAC) or AppLocker.
• Monitor for anomalous process creation (e.g., PowerShell spawning from non-admin accounts).

Indicators of Compromise (IOCs)

• File Paths: Any file path containing ../ or ..\ in the web-print-hot-folder.
• Event IDs:
  • Windows Security Event ID 4663 (File Delete) with object path under C:\ProgramData\PaperCut\web-print-hot-folder\.
  • Windows Security Event ID 4688 (Process Creation) for suspicious processes (e.g., powershell.exe launched by a low-privilege user).
• Registry Keys: N/A
• Network Indicators: N/A (local vulnerability)

Detection Engineering

YARA Rule

rule CVE_2024_8404_File_Deletion
{
    meta:
        description = "Detects attempts to exploit CVE-2024-8404 via path traversal in PaperCut web-print-hot-folder"
        author = "Valters IT"
        date = "2025-05-20"
        reference = "CVE-2024-8404"
    strings:
        $path_traversal = /\.\.(\/|\\)/ nocase
        $hot_folder = "web-print-hot-folder" nocase
    condition:
        $hot_folder and $path_traversal
}

Sigma Rule

title: CVE-2024-8404 - PaperCut Arbitrary File Deletion via Web Print
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects file deletion events in PaperCut web-print-hot-folder with path traversal
author: Valters IT
date: 2025-05-20
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-8404
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4663
        ObjectName|contains: 'web-print-hot-folder'
        AccessMask: '0x6'  # DELETE
    filter:
        ObjectName|contains: '..'
    condition: selection and filter
falsepositives:
    - Legitimate administrative actions
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-8404 - PaperCut Web Print Path Traversal Attempt"; flow:to_server,established; content:"web-print-hot-folder"; nocase; content:".."; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Local Login: Ensure only Administrators can log into the Windows Server hosting PaperCut NG/MF.
2. Disable Web Print: If not required, disable the Web Print feature to eliminate the attack vector.
3. Monitor Logs: Enable auditing for file deletion events and review logs for suspicious activity.

Long-Term Fix:

• Apply the official patch from PaperCut once released (refer to May 2025 Security Bulletin).
• Implement application-level input validation and path canonicalization.

Workarounds:

• Use Windows Defender Application Control (WDAC) to block unauthorized executables.
• Deploy endpoint detection and response (EDR) solutions to detect anomalous behavior.

Valters IT