New PaperCut critical bug exposes unpatched servers to RCE attacks

Share:

PaperCut recently fixed a critical security vulnerability in its NG/MF print management software that allows unauthenticated attackers to gain remote code execution on unpatched Windows servers.

Tracked as CVE-2023-39143, the flaw results from a chain of two path traversal weaknesses discovered by Horizon3 security researchers that enable threat actors to read, delete, and upload arbitrary files on compromised systems following low-complexity attacks that don’t require user interaction.

While it only impacts servers in non-default configurations where the external device integration setting is toggled, Horizon3 said in a report published on Friday that most Windows PaperCut servers have it enabled.

“This setting is on by default with certain installations of PaperCut, such as the PaperCut NG Commercial version or PaperCut MF,” Horizon3 said.

“Based on sample data we have collected at Horizon3 from real-world environments, we estimate that the vast majority of PaperCut installations are running on Windows with the external device integration setting turned on.”

You can use the following command to check if a server is vulnerable to CVE-2023-39143 attacks and is running on Windows (a 200 response indicates the server needs patching):

curl -w "%{http_code}" -k --path-as-is "https://<IP>:<port>/custom-report-example/......deploymentsharpiconshome-app.png"

Admins who cannot immediately install security updates (as Horizon3 advises) can add only the IP addresses that need access to an allowlist using these instructions.

Shodan search shows that roughly 1,800 PaperCut servers are currently exposed online, although not all are vulnerable to CVE-2023-39143 attacks.

PaperCut print servers exposed online
PaperCut print servers exposed online (Shodan)

Targeted by ransomware gangs, state hackers

PaperCut servers were targeted by several ransomware gangs earlier this year by exploiting another critical unauthenticated RCE vulnerability (CVE-2023–27350) and a high-severity information disclosure flaw (CVE-2023–27351).

The company disclosed on April 19th that these vulnerabilities were being actively exploited in attacks, urging admins and security teams to upgrade their servers urgently.

A few days after the initial disclosure, Horizon3 security researchers released an RCE Proof-of-Concept (PoC) exploit, opening the door for additional threat actors to target vulnerable servers.

Microsoft linked the attacks targeting PaperCut servers to the Clop and LockBit ransomware gangs, who used the access to steal corporate data from compromised systems.

In these data theft attacks, the ransomware operation took advantage of the ‘Print Archiving‘ feature that saves all documents sent through the PaperCut printing servers.

Almost two weeks after, Microsoft revealed that Iranian state-backed hacking groups tracked as Muddywater and APT35 also joined the ongoing assault.

CISA added the CVE-2023–27350 RCE bug to its list of actively exploited vulnerabilities on April 21st, ordering all U.S. federal agencies to secure their servers by May 12th, 2023.

 

(c) Lawrence Abrams

Leave a Comment

Your email address will not be published. Required fields are marked *

loader-image
London, GB
10:08 am, Jul 11, 2025
weather icon 27°C
L: 25° | H: 28°
few clouds
Humidity: 51 %
Pressure: 1021 mb
Wind: 2 mph ENE
Wind Gust: 4 mph
UV Index: 0
Precipitation: 0 mm
Clouds: 13%
Rain Chance: 0%
Visibility: 10 km
Sunrise: 4:56 am
Sunset: 9:15 pm
DailyHourly
Daily ForecastHourly Forecast
Today 10:00 pm
weather icon
25° | 28°°C 0 mm 0% 8 mph 47 % 1021 mb 0 mm/h
Tomorrow 10:00 pm
weather icon
18° | 30°°C 0 mm 0% 9 mph 65 % 1018 mb 0 mm/h
Sun Jul 13 10:00 pm
weather icon
17° | 27°°C 0 mm 0% 7 mph 73 % 1014 mb 0 mm/h
Mon Jul 14 10:00 pm
weather icon
20° | 29°°C 0 mm 0% 14 mph 71 % 1017 mb 0 mm/h
Tue Jul 15 10:00 pm
weather icon
15° | 27°°C 0 mm 0% 13 mph 71 % 1021 mb 0 mm/h
Today 1:00 pm
weather icon
28° | 29°°C 0 mm 0% 3 mph 46 % 1021 mb 0 mm/h
Today 4:00 pm
weather icon
30° | 31°°C 0 mm 0% 5 mph 33 % 1019 mb 0 mm/h
Today 7:00 pm
weather icon
28° | 28°°C 0 mm 0% 5 mph 28 % 1017 mb 0 mm/h
Today 10:00 pm
weather icon
22° | 22°°C 0 mm 0% 8 mph 47 % 1019 mb 0 mm/h
Tomorrow 1:00 am
weather icon
18° | 18°°C 0 mm 0% 4 mph 55 % 1018 mb 0 mm/h
Tomorrow 4:00 am
weather icon
19° | 19°°C 0 mm 0% 4 mph 65 % 1018 mb 0 mm/h
Tomorrow 7:00 am
weather icon
19° | 19°°C 0 mm 0% 6 mph 64 % 1018 mb 0 mm/h
Tomorrow 10:00 am
weather icon
24° | 24°°C 0 mm 0% 6 mph 45 % 1017 mb 0 mm/h
Name Price24H (%)
Bitcoin(BTC)
€100,841.64
6.06%
Ethereum(ETH)
€2,566.33
7.67%
Tether(USDT)
€0.85
0.01%
XRP(XRP)
€2.21
5.58%
Solana(SOL)
€139.88
3.08%
USDC(USDC)
€0.85
0.01%
Dogecoin(DOGE)
€0.168943
8.29%
Shiba Inu(SHIB)
€0.000011
5.70%
Pepe(PEPE)
€0.000011
13.96%
Peanut the Squirrel(PNUT)
€0.246894
20.17%
Scroll to Top