PaperCut Patches a 0-Day: Every Version of NG and MF at Risk

PaperCut has told customers that attackers are actively exploiting a vulnerability in its print management software. According to the vendor, the issue affects all versions of PaperCut NG and PaperCut MF. An emergency update has already been released for the v25 and v26 branches.

PaperCut said it is aware of “confirmed customer incidents” and is treating the situation “with the highest priority.” The investigation is ongoing, and there are as yet no technical details about the flaw itself, how it is being exploited, or the groups behind the attacks.

How to spot a compromise

The company has published the first indicators of compromise. Warning signs include:

• alerts from intrusion detection, endpoint protection, or network monitoring systems tied to the PaperCut application server — in particular, suspicious activity from the pc-app.exe process;
• missing, unexpectedly truncated, or deleted server.log log files;
• the appearance in server.log of lines such as ERROR No suitable driver found for jdbc:no:x and ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST.

What to do right now

Administrators whose PaperCut NG/MF application server is reachable from the internet are strongly urged to immediately restrict access to trusted IP addresses. “Use firewall rules, network access controls, or equivalent measures to make the PaperCut server web interfaces unreachable from untrusted addresses,” the notice reads. “Do this now, even if you have not observed any suspicious activity.”

PaperCut products have been targeted before. In 2023, a critical vulnerability, CVE-2023-27350 (CVSS score 9.8), in MF and NG was used by Russian attackers as well as the financially motivated group Lace Tempest to deliver the Cl0p and LockBit ransomware. Given how widely PaperCut solutions are deployed across corporate and educational environments, promptly applying the patch and isolating the server from the outside network looks like the only sensible response until the full picture of the attack emerges.

Source: The Hacker News